Arsenal revamped: Core Werewolf hits Russian organizations with CoreRAT
Overview
From June to July 2026, we recorded Core Werewolf and detected a previously undocumented CoreRAT. The malicious payload was distributed via the 7zSFX and Rust droppers. The threat actor penetrated infrastructures through phishing messages on Telegram. We assumed the attackers targeted Russia’s public sector and defense industry. Our retrospective analysis identified that CoreRAT had been used since at least March 2026.
Key findings
- Fueled by the ongoing geopolitical tensions, Core Werewolf continued to attack Russia’s public sector and defense industry.
- The cluster employed its own CoreRAT instead of the legitimate UltraVNC remote access software. This helped the attackers stay under the radar longer and demonstrated their growing technical capabilities. Core Werewolf had already used custom minibackdoors, but CoreRAT was its first fully operational RAT.
- To make phishing messages more convincing, the threat actor used specially crafted decoy PDFs disguised as official military and government documents.
Сampaigns
7zSFX dropper
Core Werewolf distributed 7zSFX under these names:
Scan_437_ТЛГ_на_переподготовку.exe(refresher training message)исх1051_от_20.04.2026_сл паспорт.exe(passport)
The dropper contained a decoy PDF and CoreRAT, and ran:
cmd.exe /c copy /y \"%CD%\*.*\" \"%CD%\\..\\\\\ cmd.exe /c copy \"%CD%\\..\\\\FOhf6\" \"%HOMEPATH%\Desktop\CyzG.pdf\ <- copying decoy to %HOMEPATH%\Desktop cmd.exe /c copy \"%CD%\\..\\\\yNtns.GqV\" \"%HOMEPATH%\Links\Firepoin.exe\" <- copying CoreRAT to %HOMEPATH%\Links cmd.exe /c cd \"%HOMEPATH%\Links\" & start \"\" \"Firepoin.exe\" <- launching CoreRAT cmd.exe /c cd \"%HOMEPATH%\Desktop\" & start \"\" \"CyzG.pdf\" <- launching decoy
The analyzed 7zSFX samples copied the decoy to one of the paths:
%USERPROFILE%\Desktop\CyzG.pdf%USERPROFILE%\Downloads\Vppq.pdf%USERPROFILE%\Documents\EY5Tm.pdf%USERPROFILE%\Downloads\r0po.pdf%USERPROFILE%\Downloads\H5nY.pdf
The CoreRAT executable was copied to one of these paths:
%USERPROFILE%\Links\Firepoin.exe%USERPROFILE%\Links\Baresl.exe%USERPROFILE%\Links\brhost.exe%USERPROFILE%\Links\Biostars.exe%USERPROFILE%\Links\LiteEdit.exe
Rust dropper
Core Werewolf distributed the malware under these names:
Указания-[redacted]_9f36b79847.exe(instructions)Указания по [redacted]_498 от 15.06.2026_47.exe(instructions)
The dropper contained a ZIP with a decoy and CoreRAT executable, and saved the archive contents to %TEMP%.
Example target paths on the victim host:
%TEMP%\integrated.exe%TEMP%\Указания по [redacted]_498 от 15.06.2026_47.pdf%TEMP%\atrocity.exe%TEMP%\Указания-[redacted]_9f36b79847.pdf
After saving the files, the Rust dropper launched the decoy followed by the CoreRAT executable via:
cmd /c "ping.exe -n 38 127.0.0.1" & %TEMP%\integrated.exe
The analysis of other samples revealed the same file‑saving logic.
The only difference was in the CoreRAT launch command:
cmd /c "ping.exe -n 65 127.0.0.1" & %TEMP%\atrocity.exe
Decoy PDFs
Our analysis of the decoy PDFs revealed a number of signs of fabrication, including wording and phrasing atypical of official government communications, as well as artifacts of document editing and signature forgery.
FOhf6.pdf![Decoy Указания-[redacted]_9f36b79847.pdf](/upload/pic/core-werewolf-menyaet-klyki-troyan-corerat-v-atakakh-na-rossiyskie-organizatsii-02-eng.png)
Указания-[redacted]_9f36b79847.pdf
avth.gGAT.pdf
We also found that avth.gGAT.pdf was similar to Scan_125992145_TLG_na_perepodgotovku_dsp.pdf (SHA‑256: c907b15b60fe77e42d3c37932f545e5d094370d5b709966a2fb572c5a6799660), which had been used in attacks by Vortex Werewolf. This similarity could indicate that the clusters shared tools, decoys, and expertise. An alternative hypothesis was that Core Werewolf and Vortex Werewolf were part of the same group and used a common development infrastructure. However, the available data was insufficient to confirm this theory and required further investigation.
Scan_125992145_TLG_na_perepodgotovku_dsp.pdf
CoreRAT
The malware is written in C++. String constants inside CoreRAT are AES‑encrypted in CBC (AES‑CBC) mode.
At startup, CoreRAT creates mutex 301525677, then runs anti‑virtualization checks in a separate thread:
- Uses the CPUID instruction to analyze a hypervisor for
VMwareVMware,VBoxVBoxVBox,XenVMMXenVMM, andKVMKVMKVMstrings. - Analyzes the BIOSVersion and BIOSVendor parameter values in the register key
HKLM\HARDWARE\DESCRIPTION\System\BIOSforVMWandVmwaresubstrings. - Checks the number of LNK files in
%APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations. If the directory contains less than 15 LNK files, the malware identifies the environment as virtual.
If the checks fail, the malware terminates. If no signs of a virtualized environment are detected, CoreRAT decrypts C2 addresses:
dezinsekciya-top[.]ru:443|94.232.248[.]34:443|ahmetgurses[.]net:443|194.190.153[.]182:443
The C2 addresses are separated by |. CoreRAT attempts to connect to each of them until it succeeds.
After establishing the connection, the malware gathers basic information and generates a JSON object that contains:
- computer name obtained via
GetComputerNameW() - BIOSVersion register parameter value from
HKLM\HARDWARE\DESCRIPTION\System\BIOS; if the value cannot be retrieved, the stringUnknownis used instead - number of valid LNK files in
%APPDATA%\Microsoft\Windows\Recent\AutomaticDestinationswhose target file objects exist on disk - total number of LNK files in
%APPDATA%\Microsoft\Windows\Recent - list of running processes in the following format:
Image Name PID ------------------------------------------------------- [PROCESS_NAME] [PID] list of files and directories on the user’s desktop in the following format:
Desktop path is %HOMEPATH%\Desktop MM/DD/YYYY HH:MM [TYPE] [FILENAME]where MM/DD/YYYY HH:MM is the object’s last modification time
information on network adapters in the following format:
Adapter Name IP Address MAC Address ------------------------------------------------------- Name: [NAME] Description: [DESCRIPTION] MAC: [MAC_ADDR] IPv4: [IPV4_ADDR] Subnet: [SUBNET] DHCP: [Enabled/Disabled]
Once data is gathered, CoreRAT generates a JSON object containing all the obtained information.
{
"1d22922b": "1640185028",
"245c736a": [PROCESSES_LIST]
"2ca93a25": [%APPDATA%\Microsoft\Windows\Recent LNK_COUNT],
"2fe3b8c4": [DESKTOP_LS]
"8feff34e": [ADAPTERS_INFO]
"92481bcc": [%APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations RESOLVED_LNKS_COUNT],
"fb638856": [BIOSVersion],
"host_name": [HOSTNAME]
}
The generated JSON is Base58‑encoded and transmitted to the C2 via an HTTPS POST request:
hxxps://[c2]:[port]/5743e279
For network communications, the malware uses modified code from this repository.
The server returns the parameter session_token=<value> which is transmitted in the Cookie header in subsequent requests.
Upon successful registration, CoreRAT generates an HTTPS GET request to retrieve the command:
hxxps://[c2]:[port]/0a445b0e
Commands from C2 are also Base58‑encoded.
Supported commands:
| Command | Description |
|---|---|
6055bc66 [dir] |
Enumerates the specified directory contents and sends the output to the C2 in the following format: Desktop path is [DIR] MM/DD/YYYY HH:MM [TYPE] [FILENAME] |
8cb382b9 |
Generates a list of running processes and transmits it to the C2 in the following format: Image Name PID ------------------------------------------------------- [PROCESS_NAME] [PID] |
2990a8e1 |
Gathers data on network adapters and sends it to the C2 in the following format: Adapter Name: [Adapter_Name] IP Address: [IPv4] DNS Suffix: [DNS_name] |
4e86fd31 |
Generates an ARP table and transmits it to the C2 in the following format: Interface: [Interface] Internet Address Physical Address Type [ipv4] [MAC] [dynamic/static] |
434cf996 |
Generates a list of active TCP connections and related processes and transmits it to the C2 in the following format: Proto Local Address Foreign Address State PID TCP [local_ip] [remote_ip] [state] [processID] |
a004af05 |
Initiates the CoreRAT self‑deletion: the malware renames its executable to The contents of @echo off timeout /t 3 >nul del /Q "[corerat_filename].exe.1" start "" /b cmd /c "ping 127.0.0.1 -n 3 >nul && del %~f0" |
e81ff8fd [command / process] |
Runs the specified command or process via The format |
1188b874 [output] |
Downloads a file from The format |
Upon execution, the command result is encoded using Base58 and sent to the C2 via an HTTPS POST request.
hxxps://[c2]:[port]/ba4b6dc1
CoreRAT samples
Our analysis revealed other CoreRAT samples that differ by checks for signs of virtualized environment.
Possible check options:
After decryption, one of the samples generated the following list of MD5 hashes:
1c69c262000994ac06ec153469eab55b|dc8dc902852fff973c9c51cef62bb4ba|a29ba2ff5388d667cc353730075fba4b|f34f4b89e95084d3a9b00b9c878fdfca|b8d7886ca654a5e6feb3f9a56fa40b75|7228b3f08edb7754dec4d4e555fe8539
Then, it searched
%USERPROFILE%\Desktopfor.pdffiles. The sample calculated the MD5 hash for each file and matched it against the list of decrypted values. If at least one match was found, CoreRAT continued execution. We confirmed that the specified MD5 hashes corresponded to the decoy PDFs distributed with CoreRAT as part of 7zSFX droppers. Thus, the malware checked for the expected decoy, verifying that it was launched upon the dropper execution.The sample distributed via the Rust dropper implemented a different check. CoreRAT enumerated all the files in
%TEMP%and compared their creation date (year, month, and day) with its process creation date obtained viaGetProcessTimes(). If the dates matched, it calculated the MD5 hash of the file contents and then compared it with the list of known hashes:09f192018e1a42f577d0f136b59e2888|b90f78b83282a7c7ccf8b6f61ab4af4d|6dbb3abbd19859c6f2771d7e32029818|7c3754bb07904de3708f1fae02bb9d0c|ad5f31bb0f53662c5ad659a3de2df2d0|d4af404ee8b55fc40b3ef620d90396aa|af7ad3dbf7666a88e19d076efe858f49|9b4f048ec84b13d5138d937109f2cdb6|73a8ef0d8fb7960ce6a29c38190aec6d|f4a647575c4fd3cb3c29b2a69c3aa6fe|907988b8337495e5245f3a01fd6fd121|808157c74ecd47961c7d2d6f934d706f|3cbb25f5f3a9ac6908d93cc58909536d|729598a8473203c1938b69995d816c31|1406fb20fce3c82bd55616e7949e7aca|6813c4f5170125d134a38ea2af45da97|b6a7dc31b3e1059b227e032f35727ebd|09c659fa24c98ba0f65c7a0369649903|a5be3e5a8bd37feee8bcff7b5d4a4dba|9e372e0f2356edd059af47e70044830a|b3eef6b2ecb165e50d057e1e210d6558|c2af530aff5108ab953eec30ec2399e7|0aaeb5c679e8f42e160248d5ef9e1d83|bd128b66eb000fd08ada754ed9ceba2e|3da4b2eaa2359e55bc33cca7468792ad|65a9da2d23cf0baae86bd0be8d97ed03|eee77075b5077c5abf03a9e09567ca08|2304e7a62565f45db890a341fb7a7d70|305b6e15b0209a0684fc6d8352b49839|65d112c2e2673d5fa5b22deb1b4a430e|5bef05f58d53791fc49ee8d66f2cb652|a2ef7d18d943af3c9dc6e9960f26ccbd|bb7eae1628af407ed9fc0240e92eccfe|b1410e77bfee794f52adc29e0ef9aed6|d98ed128086144ef699ef7584f858aa1|bc0608ca923518bb05bc00b608f377eb|04028f5fd20a6fa60694962ae72bb96f|4ced3337ca412a638a504e697caa954f|3454030cd9b40280f1a0e7e585c0f639|761f92ed3f949daa790b2cc96d2efbd5|0d003702bec166aec8f3869d53ccf89f|9705d2d1c30b0ae4c4a50c6acb3a9dc8|3215f75e96dad896f961e13a23c5d17f|3efbb378747d3e7d96d077ec6afefbc7|63ae279bcfc0babcab0539f44b97c76a|800076766e58c0f4cfd8a929865a6c9e|92d4dabf7348b0dad11c1295b030611d|bf17c89f315e0b11a812a87783417c0f|4b0c15b864b643c3a4ab38360c7c027a|fa3948732fef4f81dbc13102db6f641f|a59c46d04b6274de33093e6d9f62f334|8d4900aed87db884e183145d2a56ea92|720e4c35995f95413d9d3d7ebe57d88f|7c3835a540173253460763b19a4565fa
This mechanism enabled the detection of files created by the Rust dropper immediately before CoreRAT was launched and allowed them to be used as an additional indicator of execution within the expected compromise chain.
One of the early samples ran anti‑virtualization checks by analyzing network adapter MAC addresses. It checked each network adapter MAC address for one of the following prefixes:
000C29 001C14 080027 000F4FThe sample also searched MAC addresses for the following substrings:
0003BA 00015D 001851 506B8D 9600Matches against these values were considered indicators of a virtualized environment, as the corresponding prefixes are used by popular hypervisors such as VMware, VirtualBox, and Microsoft Hyper‑V.
The analysis of CoreRAT samples revealed that each of them used unique C2 endpoints and varying JSON fields to gather and transmit compromised system information.
Below is an example of the data structure from another sample:
{
"diff-stats-582": "[DESKTOP_LS]",
"host_name": "[PC_NAME]",
"projection-deliver-594": "[PROCESSES_LIST]",
"seller_issue_95": -1,
"shipment-views-323": -1,
"slow-privilege-847": "[ADAPTERS_INFO]",
"version_acl": "2539284801" [BUILD_ID]
}
Command names also vary across CoreRAT samples. During the analysis, we restored their original names:
| Original name | Obfuscated name |
|---|---|
!dir |
6055bc66 , parse-299 |
!tasklist |
8cb382b9, topics_attachment_891 |
!ipconfig |
2990a8e1, identity-projection |
!arp |
4e86fd31, middleware-883 |
!netstat |
434cf996, monitor_279 |
!terminate |
a004af05, secret_892 |
!download |
1188b874, formats-daemon-380 |
!payload |
e81ff8fd, warm-762 |
Indicators of compromise
Checksums
604ffe14ab558bf79f00adbf050760ba5d0156ad7326586013c5d3fb3d7ef2f74661735db0f33dd567d29b2a056a967bb3762f831eb3678b27c4ffb06dbb8ec1465913946d4985ab60899ed2b7bc779ea83d08683c041d0e33b496358b684106b40b8978430ebbcbe8101ec51409fef86798d88e24287a1173fde2a106fd0d76d34eb87981cd144c0916b1e720b94dc22b52924b3358c32350a235925e7dfa7e
6ccfd6b2964f564ab1b308b1c6b4d78f994ec1e975f4e848620ebb302d3e70ac085db99b37298266b48dba20749c1567f99895b5ae3f60d3ea08047d3903542d
07956ee6bbd628bcaaefe36c4b01f3fe146b87df16bbbb6d884c5e5ab16088587a489dc1e1dc13ec35fb94b4faedcb294879c7fe3597888aec7ad3f516c1cc2002933405aac6676fd892ff311418877185bbaadc7151807f54a3bc3d6b75241d1402053d6edb096b59b8df3b81d56d5a30e6577f9022ef9b5dae910f328d0401909dfb4388334d66877debcb46d36c7d0a5a75c231241aa4c989ff0cafacc8f9722e7b896d5c6026af26ac368de2aed93ff341128478a6cd57849549abf773d2ea9600c3d62d807c07055f0951d08db03725417b9342a76e62410e26940500336f04ceb8d83ceb8b160314ac1829fba7054464006990e47a1493faf1185c2daba4f21177027e07280edf929adfd1403e0f4e7eb1892ca38069d45a9cd06e2929fe2cc8991ec22325283cd246856f7869caae0ff8b4d90cbbb734593b5b3d99ed
31ef487ed72e96d3d8ce50459e2d63786f51925b6e7fc4ede372e26ea7709a1cd447e296f7da71a05d38077ae27295519151d56b6cd44ca272e731d702f7fe638925168fa34fb8e823f7329fb775b6c2cc3b41767524fc639452e93ec5c360e19a1491258e5d0131b0bb237c7221016c737af79961427c1f2fed9f80d75787b37c5dd94fbda84bd1dc9122dc7f6b2df1469f9e757f7ca577ba82d3ab4bc13d081641001dd82ed4e7ad59dfc4e5f4d9c6cd9937d47a6e59931d382926c0632de3be8a351d80e15c6ae88dd566939600162375441c538ee61be36bb81c93da182f
Network indicators
teambusiness-mail[.]ru:443xakklinkprik[.]ru:443dezinsekciya-top[.]ru:443ahmetgurses[.]net:443msgntfsys[.]link:443arendelle[.]ru:443sgpsib[.]ru:443
185.102.139[.]30:443130.49.181[.]212:443138.124.76[.]77:44395.81.125[.]145:443178.253.39[.]45:443104.128.129[.]184:44395.215.108[.]140:44345.128.150[.]49:443195.47.250[.]173:44391.212.150[.]141:4435.101.88[.]7:443194.190.153[.]182:44394.232.248[.]34:443
MITRE ATT&CK
| Tactic | Technique | Procedure |
|---|---|---|
Execution |
Command and Scripting Interpreter: Windows Command Shell |
Core Werewolf employs a 7zSFX dropper to copy and launch the CoreRAT payload via
Uses the Rust dropper to delay the CoreRAT startup and execution via
|
|
Native API |
Leverages CoreRAT to run commands and processes via |
|
Stealth |
Deobfuscate/Decode Files or Information |
Employs CoreRAT to decrypt strings and C2 addresses using AES‑CBC, and to decrypt the downloaded files with the key |
|
Indicator Removal: File Deletion |
Initiates the CoreRAT self‑deletion via
|
|
|
Obfuscated Files or Information: Embedded Payloads |
Leverages a 7zSFX dropper to unpack and launch CoreRAT and a decoy. Uses a Rust dropper to unpack an embedded ZIP archive containing CoreRAT and a decoy into |
|
|
Virtualization/Sandbox Evasion: System Checks |
Employs CoreRAT to run anti‑virtualization checks: analyze hypervisors for |
|
Discovery |
File and Directory Discovery |
Employs CoreRAT to enumerate files in the specified directory via |
|
Process Discovery |
Leverages CoreRAT to generate a list of running processes via |
|
|
Query Registry |
Uses CoreRAT to read the |
|
|
System Information Discovery |
Leverages CoreRAT to gather system information, including the computer name ( |
|
|
System Network Configuration Discovery |
Uses CoreRAT to gather network adapter data via |
|
|
System Network Connections Discovery |
Employs CoreRAT to generate a list of active TCP connections and related processes via |
|
Command and Control |
Application Layer Protocol: Web Protocols |
Leverages CoreRAT to communicate with the C2 via HTTPS |
|
Data Encoding: Non-Standard Encoding |
Uses CoreRAT to Base58‑encode transferred data and commands |
|
|
Ingress Tool Transfer |
Employs CoreRAT to download files from the C2 via |
Building an effective cybersecurity strategy against Core Werewolf and similar clusters requires knowledge of the current threat landscape and an understanding of the tools and techniques used by threat actors. The BI.ZONE Threat Intelligence portal provides organizations with timely insights on indicators of compromise and adversary toolkits. This information facilitates incident response and helps build corporate defenses against relevant threats.
However, effective protection demands timely detection and containment of attempted intrusions. EDR solutions such as BI.ZONE EDR enable early detection of attacks and immediate incident response—either automated or manual.