kyber.today

daily cyber × ai intelligence

← threat actors

threat actor

UAC-0226

also tracked as gorbag 1

1 story · 1 in the wild · November 4, 2026 – November 4, 2026

evidence: 1 observed

how they got in

  • phishing email 1 · Nov 4

sectors

  • defense 1 · Nov 4
  • government 1 · Nov 4
  • legal 1 · Nov 4

geography

  • russia 1 · Nov 4
  • ukraine 1 · Nov 4

malware and tools

  • beautystealear 1 · Nov 4
  • giftedcrook 1 · Nov 4

techniques

  • credential access 1 · Nov 4
  • dll sideloading 1 · Nov 4

attack phases seen

  • Collection 1 · Nov 4
  • Initial access 1 · Nov 4

what we reported, newest first, grouped by story

Oct 16 – November 4, 2026

  • ESET detailed Gorbag, a Russia-aligned actor active since at least February 2025 and targeting only Ukrainian entities — law enforcement and justice bodies, local administrations near the front line, and defense. Its GIFTEDCROOK and BeautyStealer tools pull browser credentials, OpenVPN configs, KeePass databases and RDP/VPN configs to Telegram or a FastAPI C2, delivered via XLSM macros and, earlier, WinRAR CVE-2025-8088 sideloading; ESET suggests it may be a first-stage access broker. The cluster overlaps CERT-UA's UAC-0226 (WeLiveSecurity). Nextron published IOCs and notes its generic YARA caught each stage well ahead of publication, including weaponized LNKs one day after first submission in February 2026 (Nextron). · Nov 4 · observed · via phishing email · as gorbag · Nation-State & Espionage