Nation-state APTEspionage
Gorbag
Gorbag is a Russia-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets the Government, and Defense and Aerospace sectors in Ukraine. It uses 3 MITRE ATT&CK techniques.
- Origin
- Russia
- Techniques
- 3
- Exploited CVEs
- No CVE data
- Record updated
Who They Target.
Sectors · 2
Countries · 1
How They Operate · MITRE ATT&CK.
3 techniques across 2 of 14 tacticsReconnaissance·
Resource Development·
Initial Access·
Execution·
Persistence·
Privilege Escalation·
Defense Evasion·
Credential Access2
T1552.001
Unsecured Credentials: Credentials In Files
Unsecured Credentials: Credentials In Files
T1555
Credentials from Password Stores
Credentials from Password Stores
Discovery·
Lateral Movement·
Collection1
T1005
Data from Local System
Data from Local System
Command and Control·
Exfiltration·
Impact·
Arsenal · Malware And Tools.
- BeautyStealermalware
Last updated Nov 3, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.