Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware ESET has been tracking a Russia-aligned group it calls Gorbag, which has been breaking into Ukrainian organizations since at least February 2025 using spearphishing attachments and a stealer that erases itself once the data is gone. Spearphishing email message from a compromised email sender (Source: ESET) Every target ESET identified sits in Ukraine. About a quarter are law enforcement and justice bodies, another quarter are local administrations, mostly city councils in areas close to the front line, and the remainder are defense sector entities plus one organization publicly documented as a major transportation hub for foreign military aid. Nearly every city whose council was targeted has been subjected…