As cited
Copy frozen at (site build).
threat intel
Russia Smashes and Grabs Credentials in Ukrainian Campaign
A Russia-aligned cyberespionage group called Gorbag is deploying an infostealer named BeautyStealer to extract login credentials, virtual private network (VPN) configurations, and files from Ukrainian government, defense, and law enforcement agencies. The campaign appears designed to facilitate deeper system access and gather intelligence during the ongoing conflict.
Why it matters: Ukrainian government and defense personnel face credential compromise that could enable attackers to establish persistent access to critical systems; organizations supporting Ukraine should assume targeted employees need immediate credential rotation and VPN reissuance.
- First seen by Cybersecurity Tracker