- ESET Resea ch has discove ed highly ta geted attacks staged by Go bag taki g place si ce Feb ua y 2025, pa ticula ly focused o Uk ai ia o ga izatio s ea the Russia-Uk ai e bo de .
- Ta gets alig closely with Russia st ategic p io ities: Uk ai ia law e fo ceme t a d justice e tities, local admi ist atio s, the defe se secto , a d a majo t a sit hub fo fo eig milita y aid.
- Malwa e is delive ed via spea phishi g emails with malicious attachme ts.
- The ope atio al focus is o o e-time i fo matio ha vesti g athe tha lo g-te m access, which may i dicate a ole as a i itial access b oke fo othe Russia-alig ed th eat acto s.
- I ea ly 2026, Go bag updated its comp omise chai to abuse CVE-2025-8088, a Wi RAR path t ave sal vul e ability discove ed a d epo ted by ESET Resea ch.
BRATISLAVA, Slovakia a d MONTREAL, Nov. 03, 2026 (GLOBE NEWSWIRE) — ESET esea che s have u cove ed a Russia-alig ed cybe espio age g oup usi g simple steale s to ha vest data f om Uk ai ia o ga izatio s ea the f o t li e. Active si ce at least Feb ua y 2025, the g oup has focused exclusively o Uk ai ia ta gets, with a clea p efe e ce fo law e fo ceme t a d justice e tities, local admi ist atio s ea the f o t li e, a d the defe se secto .
“Rathe tha elyi g o sophisticated impla ts fo lo g-te m access, Go bag uses a small toolset built fo apid collectio . B owse c ede tials, VPN co figu atio s, a d selected docume ts a e gathe ed i a si gle pass befo e the deployed malwa e attempts to emove itself,” says ESET esea che Damie Schaeffe , who discove ed a d i vestigated Go bag. “O e possible expla atio fo this app oach is that Go bag ope ates as a i itial access b oke , sha i g collected c ede tials a d othe mate ial with othe th eat acto s fo follow-o activity. If so, Go bag may ep ese t o ly the fi st stage of a lo ge i t usio chai whose late stages emai to be obse ved. Its ta geti g choices closely alig with Russia’s wa time i tellige ce p io ities,” adds Schaeffe .
All Go bag ta gets ide tified by ESET Resea ch a e located i Uk ai e, a d the g oup’s ta geti g choices fall i to th ee mai a eas that alig closely with Russia wa time i tellige ce p io ities. About a qua te of Go bag’s ta gets a e Uk ai ia gove me tal o ga izatio s active i the law e fo ceme t a d justice secto s. Uk ai e’s judicia y has emai ed active i buildi g wa c ime cases as the wa co ti ues, with seve al hu d ed i dictme ts al eady issued. A othe qua te of Go bag’s ta gets a e local gove me tal e tities, most of them city cou cils i a eas close to the f o t li e. Although local admi ist atio s may seem like u usual espio age ta gets, seve al hypotheses ca explai this choice, i cludi g battle damage assessme ts a d mo ito i g of local defe se i itiatives. The emai i g ta gets i clude a va iety of e tities i the defe se secto , as well as a e tity that has bee publicly docume ted as a majo t a spo t hub fo fo eig milita y aid. This i f ast uctu e has also bee subjected to Russia ai st ikes, which suggests that Go bag’s i te est may be a combi atio of damage assessme t a d visibility i to i comi g milita y supplies.
Th oughout 2025, Go bag elied o spea phishi g emails co tai i g a malicious attachme t. The docume ts used as lu es featu e official o gove me tal themes, such as admi ist ative fi es o taxes. I ea ly 2026, the comp omise chai cha ged. Go bag bega delive i g weapo ized RAR a chives that exploit CVE-2025-8088, a Wi RAR path t ave sal vul e ability epo ted by ESET Resea ch i August 2025. Back the , ESET esea che s fi st oticed the vul e ability bei g exploited as a ze o day by RomCom, a othe Russia-alig ed g oup k ow fo both cybe c ime a d espio age ope atio s. Whe ope ed o a vul e able system, the a chive displays a decoy PDF file while d oppi g a LNK file i to the Wi dows Sta tup folde , alo g with a e c ypted payload a d a Powe Shell loade .
The g oup’s toolset co sists of a Powe Shell eve se shell P ime Reve seShell a d b owse -data a d file steale BeautySteale , both amed by ESET. The g oup’s mai data-collectio tool is BeautySteale , which ta gets cookies, sto ed passwo ds, a d local state f om the Ch ome, Edge, Ope a, a d Fi efox b owse s; Ope VPN co figu atio s f om both use a d system di ecto ies; a d files with specific exte sio s — mostly Mic osoft Office docume ts, a chives, emails, a d VPN co figu atio s — located i the victim’s Desktop, Docume ts, a d Dow loads folde s, as well as o emovable media a d mapped etwo k d ives. Additio ally, a va ia t of P ime Reve seShell i cludes a comme t at the top of the sc ipt that attempts to deceive AI assista ts a d secu ity p oducts that eview the file. ESET tested two diffe e t AI assista ts agai st this comme t: eithe was misled, a d both co ectly ide tified the eve se shell fu ctio ality.
ESET Resea ch p ese ted its fi di gs about the Go bag APT g oup at the 2026 Vi us Bulleti co fe e ce.
Fo mo e details about Go bag a d its a se al, check out the ESET Resea ch blogpost “Go bag: O cs at the bo de ha vesti g i tellige ce f om Uk ai e” o WeLiveSecu ity.com. Make su e to follow ESET Resea ch o Twitte (today k ow as X), BlueSky, a d Mastodo fo the latest ews f om ESET Resea ch.
ESET p otects o ga izatio s, c itical i f ast uctu e, a d i dividuals, helpi g them build digital esilie ce a d co fide ce i a i c easi gly AI-d ive wo ld. With mo e tha 35 yea s of cybe secu ity expe tise, ove 25 yea s of AI i ovatio , a d 11 global R&D ce te s, ESET develops p op ieta y tech ologies desig ed to p otect agai st evolvi g cybe th eats a d secu e the b oade AI ecosystem. G ou ded i scie tific igo a d taki g a p eemptive app oach to secu ity, ESET delive s effo tless p otectio that emai s u de expe t huma ove sight. Headqua te ed i the Eu opea U io a d p ivately ow ed, ESET p otects millio s of use s a d mo e tha 500,000 o ga izatio s ac oss 178 cou t ies. Committed to espo sible AI a d custome t ust, ESET p otects the p og ess that tech ology e ables. Fo mo e i fo matio , visit www.eset.com o follow ESET’s social media, podcasts, a d blogs.
Media co tact:Jessica Beffajessica.beffa@eset.com720-413-4938
