Core Werewolf spies on Russian defense targets
A group known as Core Werewolf built its own spy tool, called CoreRAT, and used it against Russian government and defense organizations. Once installed, it lets the attackers see files, run commands, and pull more malicious tools onto the infected computer.
- Report priority
- Medium
- Targets
- Linux
How it works
- Victims get a Telegram message with a file disguised as a training order or passport paperwork.
- Opening it launches a decoy PDF on screen while a hidden installer quietly drops and starts CoreRAT in the background.
What to do
Staff at those organizations should be wary of any unexpected Telegram file, especially ones named like training orders or passport paperwork.
Do not open executable files sent as a scan or instruction, and security teams at Russian government and defense bodies should watch for new processes in Links or Temp folders and unexpected HTTPS traffic to unfamiliar servers.
Technical details
Affected software: Linux
Core Werewolf sends a Telegram message with a file made to look like an official training order or passport document. The victim opens it and sees a normal looking PDF, but a hidden installer has already copied CoreRAT into a folder like Links or Temp and started it running. From there CoreRAT collects the computer name, running processes, and network details, then quietly reports back to the attacker's server over normal-looking web traffic so operators can list files, run commands, and install more malware.
CoreRAT is a custom C++ remote access trojan that BI.ZONE describes as Core Werewolf's first fully operational RAT, replacing the group's earlier reliance on the legitimate UltraVNC tool and smaller custom backdoors. It encrypts its internal strings with AES and runs anti-sandbox and anti-VM checks before executing. Delivery uses two droppers: a 7zSFX package that drops the decoy and a file such as Firepoin.exe into the Links folder, and a Rust-based dropper that unpacks a ZIP into Temp and pings the loopback address to stall before launching. One decoy PDF overlapped with material tied to the Vortex Werewolf cluster, though BI.ZONE says that is not confirmed evidence of a shared toolset.