Core Werewolf Hackers Deploy New CoreRAT Malware Against Russian Government and Defense Organizations

The Core Werewolf espionage cluster has introduced a previously undocumented remote access trojan dubbed CoreRAT in targeted attacks on Russian public-sector bodies and defense-industry organizations.

The shift is notable because Core Werewolf, previously associated with the abuse of legitimate UltraVNC remote-access software and smaller custom backdoors, now operates a full-featured C++ RAT of its own.

The change reduces reliance on publicly available tools, complicates detection based on known UltraVNC abuse patterns, and signals a more mature in-house malware-development capability.

The operators reportedly gained initial access through phishing messages delivered on Telegram. Lures impersonated official military and government correspondence, using filenames referring to refresher training, passports, and official instructions.

The social-engineering component relied on decoy PDFs, which were displayed to victims after execution to make the malicious attachment appear legitimate.

Researchers identified indicators of fabrication in the PDFs, including phrasing inconsistent with authentic government communications, artifacts of document editing, and forged signatures.

One decoy was also similar to a document previously used by the Vortex Werewolf cluster. BI.ZONE said the overlap may point to shared decoys, tooling, expertise, or infrastructure, but stressed that available evidence was insufficient to confirm an operational link between the groups.

Core Werewolf used two delivery mechanisms: self-extracting 7zSFX archives and Rust-based droppers.

BI.ZONE researchers observed the campaign between June and July 2026, while retrospective analysis traced CoreRAT activity back to at least March.

Core Werewolf espionage cluster

The 7zSFX samples unpacked a decoy PDF alongside CoreRAT, copied the lure to common user folders such as Desktop, Downloads, or Documents, and placed the RAT in the user’s Links directory under benign-looking executable names including Firepoin.exe, Baresl.exe, and Biostars.exe.

Rust droppers followed a similar pattern, extracting a ZIP archive into %TEMP%, opening the decoy PDF, and launching CoreRAT after a delay created with ping.exe.

This execution order helps ensure the victim sees an apparently relevant document while the implant initializes in the background.

CoreRAT is written in C++ and encrypts embedded strings with AES-CBC. Before contacting its command-and-control infrastructure, it creates mutex 301525677 and runs anti-virtualization checks in a separate thread.

The malware inspects CPUID hypervisor identifiers, BIOS registry values, virtual-machine MAC-address prefixes, and the number of Windows shortcut artifacts in AutomaticDestinations.

The shortcut check is particularly relevant: if fewer than 15 LNK files are present in %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations, CoreRAT may classify the host as a virtualized or analysis environment and terminate.

Other samples validate that the expected decoy PDF or recently created dropper artifacts exist before proceeding, binding execution to the intended phishing chain rather than allowing the malware to run freely in sandboxes.

Once active, CoreRAT decrypts a list of C2 endpoints and attempts HTTPS connections until one succeeds. It collects the hostname, BIOS version, running processes, desktop contents, network-adapter details, and LNK-file telemetry.

The data is assembled into JSON, Base58-encoded, and sent via an HTTPS POST request to a hard-coded path. The server returns a session_token cookie used in follow-on requests.

The RAT supports directory enumeration, process discovery, adapter reconnaissance, ARP-table collection, active TCP-connection mapping, arbitrary command execution, payload download and execution, and self-deletion.

Downloaded files can be AES-CBC decrypted before execution, giving operators a mechanism to stage additional tooling after initial compromise.

Defenders should review Telegram-originated files masquerading as government or defense documents, especially self-extracting archives and executables that create PDFs in user-accessible folders before launching binaries from %USERPROFILE%\Links or %TEMP%.

Network teams should hunt for unusual HTTPS POST and GET traffic to rare domains or IP-based endpoints, particularly requests using the CoreRAT URI patterns /5743e279, /0a445b0e, /ba4b6dc1, and /97e8be66.

The campaign highlights a broader operational evolution: Core Werewolf is moving from abuse of legitimate remote-access tools toward tailored malware designed for stealth, selective execution, and sustained espionage inside Russian government and defense environments.

Indicators of compromise

Type	Indicator	Port
Domain	teambusiness-mail[.]ru	443
Domain	xakklinkprik[.]ru	443
Domain	dezinsekciya-top[.]ru	443
Domain	ahmetgurses[.]net	443
Domain	msgntfsys[.]link	443
Domain	arendelle[.]ru	443
Domain	sgpsib[.]ru	443
IP address	185.102.139[.]30	443
IP address	130.49.181[.]212	443
IP address	138.124.76[.]77	443
IP address	95.81.125[.]145	443
IP address	178.253.39[.]45	443
IP address	104.128.129[.]184	443
IP address	95.215.108[.]140	443

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide