{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Gorbag acts as an initial access broker for Russia-aligned APTs, harvesting intelligence for strategic battle damage assessment. Detecting their tools in the collection phase prevents the follow-on intrusions that these stolen credentials enable." }, "name": "Gorbag: Browser Data Harvesting and Exfiltration", "type": "investigation", "labels": [ "hunt", "attack.t1555.003", "attack.t1539", "attack.t1217", "attack.t1005", "attack.t1071.001", "attack.t1567", "attack.t1048.001", "attack.t1070.004", "attack.t1560", "command and control", "credential access", "defense evasion", "execution", "initial access", "persistence" ], "series": { "slug": "gorbag-orcs-at-the-border-harvesting-intelligence-from-ukraine", "index": 2, "title": "Gorbag: Orcs at the border harvesting intelligence from Ukraine", "total": 2 }, "related": [ { "hunt": "winrar-exploit-startup-persistence", "reason": "This hunt focuses on the collection and exfiltration phase; the WinRAR exploit and startup folder persistence are covered in a companion hunt.", "relation": "out-of-scope-alternative" }, { "hunt": "gorbag-rapid-harvester-deployment", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single detection rule would miss the 'one-pass' nature of this threat. This hunt pivots between unauthorized credential access, rare process behavior stack-counting, and network exfiltration patterns, providing context that an analyst must weigh to confirm the intrusion.", "coverage": [ { "stage": "browser-intel-harvesting", "steps": [ "suspicious-credential-access", "rare-process-file-behavior" ], "status": "covered" }, { "stage": "network-c2-and-exfiltration", "steps": [ "exfiltration-network-traffic" ], "status": "covered" }, { "stage": "post-intrusion-cleanup", "steps": [ "rare-process-file-behavior" ], "status": "covered" }, { "stage": "spearphishing-delivery", "reason": "Belongs to another part of the 'Gorbag: Orcs at the border harvesting intelligence from Ukraine' series.", "status": "out_of_scope" }, { "stage": "exploit-winrar-traversal", "reason": "Belongs to another part of the 'Gorbag: Orcs at the border harvesting intelligence from Ukraine' series.", "status": "out_of_scope" }, { "stage": "dropper-execution-vba-ps", "reason": "Belongs to another part of the 'Gorbag: Orcs at the border harvesting intelligence from Ukraine' series.", "status": "out_of_scope" }, { "stage": "startup-persistence", "reason": "Belongs to another part of the 'Gorbag: Orcs at the border harvesting intelligence from Ukraine' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Spearphishing with Malicious Lures", "slug": "spearphishing-delivery", "tactic": "initial-access", "techniques": [ "T1566.001", "T1199" ], "observables": [ "\u0434\u043e\u0434\u0430\u0442\u043e\u043a \u043f\u043e\u0434\u0430\u0442\u043a\u043e\u0432\u0430.xlsm", "\u041f\u043e\u0432\u0456\u0434\u043e\u043c\u043b\u0435\u043d\u043d\u044f 4726-49.rar", "Email subjects regarding administrative fines or taxes" ] }, { "name": "WinRAR Path Traversal Exploitation", "slug": "exploit-winrar-traversal", "tactic": "execution", "techniques": [ "T1203" ], "observables": [ "CVE-2025-8088", "Extraction of alternate data streams outside directory", "LNK file written to Startup folder" ] }, { "name": "Macro or PowerShell Dropper Execution", "slug": "dropper-execution-vba-ps", "tactic": "execution", "techniques": [ "T1059.001", "T1027.009" ], "observables": [ "VBA decoding base64 from Excel cells", "Payload dropped into %ProgramData%", "PowerShell loader in %ProgramData%" ] }, { "name": "Persistence via Startup Folder", "slug": "startup-persistence", "tactic": "persistence", "techniques": [ "T1547.001" ], "observables": [ "LNK file in %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" ] }, { "name": "Rapid Browser and VPN Data Theft", "slug": "browser-intel-harvesting", "tactic": "credential-access", "techniques": [ "T1555.003", "T1539", "T1217", "T1005" ], "observables": [ "BeautyStealer access to browser profile databases", "Collection of VPN configurations", "Staging of documents for exfiltration" ] }, { "name": "C2 and Telegram Exfiltration", "slug": "network-c2-and-exfiltration", "tactic": "command-and-control", "techniques": [ "T1071.001", "T1567", "T1048.001" ], "observables": [ "HTTPS connection to 89.44.9.186 (Prime ReverseShell)", "Exfiltration to 142.111.194.73", "Data exfiltration via Telegram API", "RC4 encrypted payloads" ] }, { "name": "Self-Deletion Cleanup", "slug": "post-intrusion-cleanup", "tactic": "defense-evasion", "techniques": [ "T1070.004" ], "observables": [ "Malware binary removal from %ProgramData% after single pass execution" ] } ], "summary": "Gorbag is a Russia-aligned threat actor targeting Ukrainian law enforcement and defense sectors since 2025. They utilize spearphishing with macro-enabled spreadsheets or WinRAR exploits (CVE-2025-8088) to deploy BeautyStealer for rapid credential and file harvesting and Prime ReverseShell for command and control before performing self-deletion." }, "severity": "high", "rationale": "Focus the hunt on Ukrainian justice, law enforcement, and defense sector entities. Prioritize systems where WinRAR is installed or systems belonging to administrative staff who process fines or tax documents.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "A Russia-aligned actor is stealing browser credentials and VPN configurations, exfiltrating them via Telegram or direct IP, and then deleting the evidence from disk.", "parameters": { "gorbag_ips": { "from": { "ref": "eset-research", "kind": "article", "observed": "2026-11-03" }, "type": "list[ip]", "default": [ "89.44.9.186", "142.111.194.73" ], "description": "C2 and exfiltration IPs identified in the report." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Limit the hunt to specific hosts; leave empty to hunt across the entire estate." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "gorbag_domains": { "from": { "ref": "eset-research", "kind": "article", "observed": "2026-11-03" }, "type": "list[domain]", "default": [ "psw.agent.ma", "agent.eji", "runner.fb" ], "description": "C2 domains identified in the report." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/", "name": "Gorbag: Orcs at the border harvesting intelligence from Ukraine" } ], "blind_spots": [ { "id": "no-file-telemetry", "risk": "Without read auditing, unauthorized access to credentials leaves no trace in the lead query.", "owner": "Endpoint Security Team", "stage": "browser-intel-harvesting", "question": "Did any process read the browser SQLite databases?", "requires": "hb_file_activity with read-access auditing", "remediation": "Enable 'Audit File System' for application data paths under user profiles via GPO." }, { "id": "encrypted-network-exfiltration", "risk": "The use of RC4 encryption on top of HTTPS makes it impossible to determine the volume or content of stolen data from network telemetry alone.", "owner": "Network Operations", "stage": "network-c2-and-exfiltration", "question": "Was the data transmitted to Telegram or the C2 encrypted or plain text?", "requires": "HTTPS inspection or endpoint socket attribution", "remediation": "Deploy SSL inspection for traffic to known cloud services like Telegram and correlate with process telemetry." } ] }, "name": "Gorbag: Browser Data Harvesting and Exfiltration", "description": "This hunt identifies the one-pass data harvesting pattern of BeautyStealer and Prime ReverseShell, as observed in attacks against Ukrainian administrations and defense sectors. It begins by identifying unauthorized access to browser credential databases and VPN configurations. The hunt then corroborates this behavior using two parallel queries: one that identifies rare archiving and cleanup activity across the fleet, and another that matches network traffic against known exfiltration infrastructure and the Telegram API. Finally, an agent weighs the combined evidence to identify hosts where intelligence harvesting has occurred." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "gorbag-orcs-at-the-border-harvesting-intelligence-from-ukraine", "index": 2, "title": "Gorbag: Orcs at the border harvesting intelligence from Ukraine", "total": 2 }, "coverage": [ { "stage": "browser-intel-harvesting", "steps": [ "suspicious-credential-access", "rare-process-file-behavior" ], "status": "covered" }, { "stage": "network-c2-and-exfiltration", "steps": [ "exfiltration-network-traffic" ], "status": "covered" }, { "stage": "post-intrusion-cleanup", "steps": [ "rare-process-file-behavior" ], "status": "covered" }, { "stage": "spearphishing-delivery", "reason": "Belongs to another part of the 'Gorbag: Orcs at the border harvesting intelligence from Ukraine' series.", "status": "out_of_scope" }, { "stage": "exploit-winrar-traversal", "reason": "Belongs to another part of the 'Gorbag: Orcs at the border harvesting intelligence from Ukraine' series.", "status": "out_of_scope" }, { "stage": "dropper-execution-vba-ps", "reason": "Belongs to another part of the 'Gorbag: Orcs at the border harvesting intelligence from Ukraine' series.", "status": "out_of_scope" }, { "stage": "startup-persistence", "reason": "Belongs to another part of the 'Gorbag: Orcs at the border harvesting intelligence from Ukraine' series.", "status": "out_of_scope" } ], "rationale": "A Russia-aligned actor is stealing browser credentials and VPN configurations, exfiltrating them via Telegram or direct IP, and then deleting the evidence from disk.", "blind_spots": [ { "id": "no-file-telemetry", "risk": "Without read auditing, unauthorized access to credentials leaves no trace in the lead query.", "owner": "Endpoint Security Team", "stage": "browser-intel-harvesting", "question": "Did any process read the browser SQLite databases?", "requires": "hb_file_activity with read-access auditing", "remediation": "Enable 'Audit File System' for application data paths under user profiles via GPO." }, { "id": "encrypted-network-exfiltration", "risk": "The use of RC4 encryption on top of HTTPS makes it impossible to determine the volume or content of stolen data from network telemetry alone.", "owner": "Network Operations", "stage": "network-c2-and-exfiltration", "question": "Was the data transmitted to Telegram or the C2 encrypted or plain text?", "requires": "HTTPS inspection or endpoint socket attribution", "remediation": "Deploy SSL inspection for traffic to known cloud services like Telegram and correlate with process telemetry." } ], "scoping_notes": "Focus the hunt on Ukrainian justice, law enforcement, and defense sector entities. Prioritize systems where WinRAR is installed or systems belonging to administrative staff who process fines or tax documents.", "beyond_detection": "A single detection rule would miss the 'one-pass' nature of this threat. This hunt pivots between unauthorized credential access, rare process behavior stack-counting, and network exfiltration patterns, providing context that an analyst must weigh to confirm the intrusion." } }, { "id": "suspicious-credential-access", "type": "query", "label": "Suspicious browser and VPN data access", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, file_path, time FROM hb_file_activity WHERE activity_id = 2 AND (LOWER(file_path) LIKE '%\\google\\chrome\\user data%\\login data' OR LOWER(file_path) LIKE '%\\microsoft\\edge\\user data%\\login data' OR LOWER(file_path) LIKE '%\\google\\chrome\\user data%\\cookies' OR LOWER(file_path) LIKE '%.ovpn' OR LOWER(file_path) LIKE '%.pcf' OR LOWER(file_path) LIKE '%\\etc\\openvpn%') AND (LOWER(process_name) NOT LIKE '%\\chrome.exe' AND LOWER(process_name) NOT LIKE '%\\msedge.exe' AND LOWER(process_name) NOT LIKE '%\\vpn.exe' AND LOWER(process_name) NOT LIKE '%\\browser.exe') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Identify non-browser processes reading sensitive credential databases or VPN configurations as a lead for data theft.", "expected_signal": "A row names a process that has no business reading browser or VPN secrets. Silence suggests no such unauthorized access occurred via this vector." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Suspicious browser and VPN data access", "reads": [ "device_hostname", "process_name", "file_path", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, file_path, time FROM hb_file_activity WHERE activity_id = 2 AND (LOWER(file_path) LIKE '%\\google\\chrome\\user data%\\login data' OR LOWER(file_path) LIKE '%\\microsoft\\edge\\user data%\\login data' OR LOWER(file_path) LIKE '%\\google\\chrome\\user data%\\cookies' OR LOWER(file_path) LIKE '%.ovpn' OR LOWER(file_path) LIKE '%.pcf' OR LOWER(file_path) LIKE '%\\etc\\openvpn%') AND (LOWER(process_name) NOT LIKE '%\\chrome.exe' AND LOWER(process_name) NOT LIKE '%\\msedge.exe' AND LOWER(process_name) NOT LIKE '%\\vpn.exe' AND LOWER(process_name) NOT LIKE '%\\browser.exe') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "A row names a process that has no business reading browser or VPN secrets. Silence suggests no such unauthorized access occurred via this vector.", "verified": "dry-run", "verified_at": "2026-11-04" } }, { "id": "rare-process-file-behavior", "type": "query", "label": "Rare archiving and cleanup activity", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_name) AS process, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS event_count, MIN(time) AS first_seen FROM hb_file_activity WHERE ((activity_id = 1 AND (LOWER(file_path) LIKE '%.rar' OR LOWER(file_path) LIKE '%.zip' OR LOWER(file_path) LIKE '%.7z')) OR (activity_id = 4 AND LOWER(file_path) LIKE 'c:\\programdata\\%')) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1 HAVING host_count <= 3 ORDER BY host_count ASC", "surface": "hb_file_activity", "description": "Find rare processes creating archives or performing cleanup in ProgramData, characteristic of BeautyStealer.", "expected_signal": "A rare process creating archives or deleting files in common malware staging paths. Frequent processes are likely legitimate software." }, "parents": [ { "id": "suspicious-credential-access" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare archiving and cleanup activity", "reads": [ "process_name", "device_hostname", "file_path", "activity_id", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT LOWER(process_name) AS process, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS event_count, MIN(time) AS first_seen FROM hb_file_activity WHERE ((activity_id = 1 AND (LOWER(file_path) LIKE '%.rar' OR LOWER(file_path) LIKE '%.zip' OR LOWER(file_path) LIKE '%.7z')) OR (activity_id = 4 AND LOWER(file_path) LIKE 'c:\\programdata\\%')) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1 HAVING host_count <= 3 ORDER BY host_count ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A rare process creating archives or deleting files in common malware staging paths. Frequent processes are likely legitimate software.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_name" ], "rare_below": 3 }, "verified_at": "2026-11-04" } }, { "id": "exfiltration-network-traffic", "type": "query", "label": "Connections to exfiltration infrastructure", "config": { "dsl": "sqlite", "role": "triage", "source": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_hostname, time FROM hb_network_connection WHERE (instr(',' || '{{gorbag_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 OR instr(',' || '{{gorbag_domains}}' || ',', ',' || LOWER(dst_endpoint_hostname) || ',') > 0 OR LOWER(dst_endpoint_hostname) = 'api.telegram.org') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_network_connection", "description": "Match network traffic against known Gorbag infrastructure or the Telegram API used for exfiltration.", "expected_signal": "Traffic to specific IPs or the Telegram API linked to a suspicious process confirms exfiltration." }, "parents": [ { "id": "suspicious-credential-access" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Connections to exfiltration infrastructure", "reads": [ "device_hostname", "process_name", "dst_endpoint_ip", "dst_endpoint_hostname", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_hostname, time FROM hb_network_connection WHERE (instr(',' || '{{gorbag_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 OR instr(',' || '{{gorbag_domains}}' || ',', ',' || LOWER(dst_endpoint_hostname) || ',') > 0 OR LOWER(dst_endpoint_hostname) = 'api.telegram.org') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Traffic to specific IPs or the Telegram API linked to a suspicious process confirms exfiltration.", "verified": "dry-run", "verified_at": "2026-11-04" } }, { "id": "agent-triage", "type": "analytic", "label": "Triage harvesting behavior", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "suspicious-credential-access", "rare-process-file-behavior", "exfiltration-network-traffic" ], "objective": "Determine if the observed behavior on a host constitutes a Gorbag data-stealing intrusion by linking unauthorized credential access to exfiltration traffic.", "description": "Evaluate whether the combined file access, archiving, and network activity indicate an intelligence harvesting intrusion.", "max_iterations": 5, "expected_signal": "A host-by-host verdict identifying confirmed malicious data theft.", "success_criteria": "A per-host verdict of malicious | suspicious | benign, citing the rows that link the harvesting process to its exfiltration destination." }, "parents": [ { "id": "rare-process-file-behavior", "kind": "merge" }, { "id": "exfiltration-network-traffic", "kind": "merge" } ] }, { "id": "route-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "The triage verdict is malicious for at least one host, indicating data harvesting and exfiltration has occurred.", "condition": "The triage verdict is malicious for at least one host, indicating data harvesting and exfiltration has occurred.", "blind_spot": "no-file-telemetry", "confidence": "high", "description": "Direct the analyst to immediate remediation or standard review.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "agent-triage" } ] }, { "id": "remediate-and-isolate", "type": "action", "label": "Isolate host and revoke credentials", "config": { "target": "endpoint", "description": "Immediately stop ongoing exfiltration and prevent use of stolen credentials.", "instructions": "Isolate the host immediately to prevent further exfiltration. Revoke all active sessions and initiate password resets for any user whose browser profile or VPN configuration was accessed.", "action_approval": "required" }, "parents": [ { "id": "route-verdict", "branch": "on_supports" } ] }, { "id": "forensic-investigation", "type": "task", "label": "Forensic validation", "config": { "assignee": "analyst", "description": "Identify which specific files and credentials were stolen and look for signs of follow-on activity.", "instructions": "Review the file activity rows to identify the specific documents and credential stores accessed. Examine the exfiltration destination to confirm if data was successfully sent. Search for signs of lateral movement or secondary payloads that may have been deployed before BeautyStealer removed itself." }, "parents": [ { "id": "route-verdict", "branch": "default" }, { "id": "route-verdict", "branch": "on_unavailable" }, { "id": "remediate-and-isolate" } ] }, { "id": "hunt-closeout", "type": "task", "label": "Hunt closeout", "config": { "assignee": "analyst", "description": "Document findings and determine if current detection rules require tuning.", "instructions": "Record the final status of all hosts examined. If suspicious-credential-access returned high-fidelity results, promote it to a standing detection rule." }, "parents": [ { "id": "route-verdict", "branch": "on_refutes" }, { "id": "forensic-investigation" } ] } ] }