Tinker Tailor Soldier: Paper Werewolf’s latest toolkit

BI.ZONE Threat Intelligence has detected a wave of targeted attacks involving previously undocumented tools, including the PaperGrabber stealer and a custom Mythic implant

Argument	Description
`--botToken / -bot`	Telegram bot token (required)
`--channelId / -ch`	Chat/channel ID used to send stealer activity logs (required)
`--mode / -m`	Activity modes (can be combined): None (0): no action BorrowFiles (2): collect files BorrowTelegram (4): harvest Telegram data BorrowBrowserData (8): gather browser data WaitForRemovables (16): extract files from removable media (wait for removables to be connected)
`--borrowFilesType / -ft`	File collection modes (can be combined): None (0): do not collect files BorrowEssentials (2): retrieve files from user directories BorrowPhysicalDrives (4): gather files from all local drives BorrowNetworkDrives (8): fetch files from network drives All (14): all collection modes
`--uploadExtensions / -uext`	Files to upload (list of extensions)
`--logExtensions / -lext`	Files to log (list of extensions)
`--minFileSize / -minFS`	Minimum file size (bytes)
`--maxFileSize / -maxFS`	Maximum file size (bytes)

Command	Description
`exit`	Terminate and exit the main loop
`sleep`	Update interval and jitter parameters
`shell`	Execute commands via `cmd.exe`. A pipe is created, and `cmd /S /c [command]` is run through the CreateProcessW WinAPI function. After execution, the command output is read from the pipe
`activity_time`	Retrieve the implant’s schedule by day of the week (start/end times) and the current activity mode status `(mode: true/false)`, determined by time‑based execution restrictions. Example: Activity time: \ Sunday - HH:MM-HH:MM,\r\n Monday - HH:MM-HH:MM,\r\n ... Saturday - HH:MM-HH:MM,\r\n mode: true/false
`activity_time_set`	Set an activity time. Input parameters specify the allowed day of the week (* for all days) and time
`inject_shellcode`	Inject shellcode. The C2 server is expected to provide `arch` (64), `offset` (from the beginning of the file), and `file_id` (on the server). The file is loaded in 512 KB chunks, after which a new thread is created via `CreateThread([shellcode_start + offset])`
`bof`	Execute a BOF. Expected parameters: `bof_function` and `bof_arguments`
`download`	Download a file from the compromised host to the C2 server. Expected parameters: `path` and `host`. The file is read with ReadFile, its contents sent to the C2 server in 512 KB chunks
`upload`	Upload a file from the C2 server to the compromised host. Expected parameters: `remote_path` (destination path), `overwrite` (existing file), and `file_id` (on the C2 server)
`ls`	List the contents of the specified directory
`cd`	Change the working directory (in memory). Update a field in the implant’s global structure
`rm`	Remove the loaded file. Expected parameters: `path` and `host`
`pwd`	Return the implant’s working directory (in memory)
`cat`	Read the loaded file. Expected parameters: `path` and `host`. If more than 1,024 bytes are read, only the first 1,024 bytes are returned, followed by `[truncated]`
`ps`	Retrieve a list of running processes. Expected parameters: `include_command_line` and `filter` (may be empty). Collected fields include: `proc_name`, `process_id`, `parent_process_id`, `architecture`, `bin_path`, `user/host (LookupAccountSidW)`, `integrity_level`, `command_line` (if enabled), and `start_time` (process)
`kill`	Terminate the process by loaded PID via the TerminateProcess WinAPI function
`cp`	Copy a file through CopyFileW. Expected parameters: `source` and `destination`
`mv`	Move a file via MoveFileExW. Expected parameters: `source` and `destination`
`regls`	List the loaded registry hive via RegEnumKeyExW and RegEnumValueW
`regrm`	Delete a registry key value via RegDeleteValueW
`regset`	Set a registry key value via RegCreateKeyExW and RegSetValueExW. If the parameter name provided by the C2 server is Default, the `(Default)` parameter is created in the registry
`socks`	Establish a SOCKS proxy connection
`net_connection_add`	Connect to a network resource through WNetAddConnection2W. Expected parameters: `path`, `username`, and `password`
`net_connection_list`	List network resources
`net_connection_close`	Disconnect a network resource via WNetCancelConnection2W
`screenshot`	Capture a screenshot. The C2 server may optionally provide screen resolution values via `x` and `y`
`pipe_read`	Read data from a named pipe via ReadFile. Expected parameter: pipe name
`pipe_write`	Write data to the loaded pipe. Expected parameters: pipe name and data to write
`keylogger`	Read data from a process (keylogger), likely deployed separately from the C2 server. Expected parameters: pipe name and action `(read` or `exit)`. With `read`, data is read from a named pipe connected to another process. With `exit`, the keylogger terminates

Tactic	Technique	Procedure
Initial Access	Phishing: Spearphishing Attachment	Paper Werewolf distributes malicious PDF attachments via phishing emails. These decoys contain embedded links that direct victims to malicious archives
Execution	Command and Scripting Interpreter: Windows Command Shell	Employs the EchoGather RAT to remotely execute commands via `cmd.exe`. Uses the Mythic implant to remotely execute commands via `cmd.exe`: `cmd /S /c [command]`
	Command and Scripting Interpreter: Visual Basic	Uses WSFs containing VBScript code to open a PDF decoy, create an MSBuild task `(msb_cache.xml)` and a VBS `(msb_run.vbs)` to launch it, and gain persistence
	Command and Scripting Interpreter: Python	Leverages the `123.py` Python script to search the current directory for `search.bin`, read shellcode from the file, and execute that code in process memory via CreateThread
	Command and Scripting Interpreter: JavaScript	Uses a JS downloader that employs the `vain` and `vain1` Node.js scripts, along with `vni.wsf` containing JS code. Leverages the legitimate `node.exe` interpreter for execution `(yandex.exe)`: `%APPDATA%\yandex\yandex.exe %APPDATA%\yandex\vain1`
	Inter-Process Communication	Uses the Mythic implant that supports `pipe_read` and `pipe_write` commands for interacting with named pipes via ReadFile calls
	Native API	Leverages the CreateProcessA WinAPI function in EchoGather to launch processes. Uses the CreateThread WinAPI function in Python and JS loaders to execute subsequent stages as shellcode
	User Execution: Malicious Link	Attempts to trick users into clicking a link embedded in a phishing PDF and download a ZIP archive with a malicious Inno Setup installer
	User Execution: Malicious File	System compromise is initiated when a user launches a malicious EXE or WSF delivered via phishing or other channels: `Adobe_Acrobat_Reader_Plugin_ru.exe` `Форма заявки на обучение.exe` `МЕТОДИЧЕСКИЕ РЕКОМЕНДАЦИИ_по формированию прогноза поступлений налоговых платежей.wsf`
Persistence	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	Paper Werewolf employs the `vain` JS file to gain persistence. The script adds the path to `vni.wsf` to the `HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\LOAD` registry key, thus ensuring its automatic execution: `reg add "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v LOAD /t REG_SZ /d ""%APPDATA%vni.wsf\"" /f`
	Boot or Logon Initialization Scripts: Logon Script (Windows)	Uses VBScript to ensure the automatic execution of `msb_run.vbs`. The script sets the `HKCU\Environment\UserInitMprLogonScript` registry key value to execute `wscript.exe %LOCALAPPDATA%\msb_run.vbs`
Defense Evasion	Delay Execution	Employs `activity_time` and `activity_time_set` to control the Mythic implant’s activity schedule. Uses `sleep` to introduce delays between command executions
	Deobfuscate/Decode Files or Information	Leverages EchoGather to decrypt XOR‑encrypted strings
	Hide Artifacts: Hidden Window	Uses `windowsHide` when calling `exec` in the `vain` JS code to suppress visible windows during process execution: `exec(cmd, { windowsHide: true }, (error, stdout, stderr)` `exec("${exePath}" "${scriptPath}", { windowsHide: true })`
	Indicator Removal: File Deletion	Employs the Mythic implant to delete specified files on the compromised host upon receiving the `rm` command
	Masquerading	Leverages Inno Setup installers such as `Adobe_Acrobat_Reader_Plugin_ru.exe` and `Adobe_Acrobat_Reader_Plugin.exe` that mimic legitimate software
	Modify Registry	Uses the Mythic implant that supports `regls`, `regrm`, and `regset` to list, delete, and install registry keys through RegEnumKeyExW, RegDeleteValueW, RegCreateKeyExW, and RegSetValueExW
	Obfuscated Files or Information	Applies obfuscation for the Mythic implant shellcode
	Obfuscated Files or Information: Dynamic API Resolution	Uses dynamic resolution of WinAPI functions required for the Mythic implant execution
	Process Injection	Employs the Mythic implant that, upon receiving the `inject_shellcode` command, downloads shellcode from the C2 server in 512 KB chunks and executes it in a new thread via CreateThread with an offset from the beginning of the file
	Reflective Code Loading	Uses `123.py` and `ConsoleApplication1.exe` loaders to load obfuscated Mythic implant shellcode from `search.bin` and run it in the memory of the current process via CreateThread. Uses the `vain1` JS code to place received shellcode into process memory through HeapCreate and HeapAlloc and subsequently trigger execution via CreateThread. Uses a C# downloader to load a received .NET assembly into memory via `Assembly.Load` and invoke the entry point specified by the server in X‑Entry‑Point and X‑Entry‑Method headers. Employs the `Форма заявки на обучение.exe` C++ downloader to download shellcode from the C2 server and run it in the memory of the current process. Uses the Mythic implant that, upon receiving the `bof` command, executes a BOF with the provided `bof_function` and `bof_arguments` parameters
	Trusted Developer Utilities Proxy Execution: MSBuild	Uses `msb_run.vbs` to execute the MSBuild task indicated in `msb_cache.xml`: `%SYSTEMROOT%\Microsoft.NET\(Framework\|Framework64)\v4.0.30319\MSBuild.exe /nologo "%LOCALAPPDATA%\msb_cache.xml" /t:___RunHelloWorld___`
	Virtualization/Sandbox Evasion: System Checks	Employs EchoGather to run anti‑virtualization checks: matches the machine name against a predefined list checks whether the C:\ drive has less than 20 GB of space checks whether the executable file name without extension is not exactly 4 characters long Uses the `Форма заявки на обучение.exe` C++ downloader to verify the C:\ volume serial number through GetVolumeInformationA and check paths to running processes’ executables for virtual environment attributes
	Virtualization/Sandbox Evasion: Time Based Checks	Employs EchoGather to run anti‑virtualization checks: uses a high‑precision timer to measure CPU operation runtime checks the program’s actual sleep time via the Sleep function
Credential Access	Credentials from Password Stores: Credentials from Web Browsers	Uses PaperGrabber to exfiltrate credentials from browsers like Yandex Browser, Chrome, Opera, Edge, and Chromium
	Unsecured Credentials: Credentials In Files	Uses PaperGrabber to harvest the `tdata` directory that contains encrypted Telegram session files
	Unsecured Credentials: Private Keys	Uses PaperGrabber to collect files containing passwords and private keys, including SSH keys
Discovery	File and Directory Discovery	Uses PaperGrabber to recursively traverse directories to locate files by filename and extension. Employs the Mythic implant that supports the `ls`, `pwd`, and `cat` commands to exfiltrate directory contents, retrieve the current working path, and read files on a compromised host
	Peripheral Device Discovery	Uses PaperGrabber to detect connected removable and storage media by checking the `DriveType.Removable` disk type, followed by file retrieval
	Network Share Discovery	Uses the Mythic implant that lists connected network resources via `net_connection_list`
	Process Discovery	Leverages EchoGather to identify the current process ID. Employs PaperGrabber to enumerate running processes in order to locate Telegram on the system. Uses the Mythic implant that, upon receiving the `ps` command, collects a list of running processes, including process name, PID, PPID, architecture, path, user, privilege level, command line, and start time via LookupAccountSidW
	Software Discovery	Employs PaperGrabber to identify installed web browsers and the Telegram client
	System Information Discovery	Uses the EchoGather RAT to gather system information, such as system architecture, computer name, workstation configuration, and path to the running executable. Employs PaperGrabber to obtain the computer name. Uses the Mythic implant to send host data to the C2 server, including username, hostname, domain, architecture, IP addresses, process path, privilege level, and PID
	System Network Configuration Discovery	Uses EchoGather to retrieve private IP addresses
	System Owner/User Discovery	Leverages EchoGather and PaperGrabber to retrieve usernames. Uses the `vain1` JS code to collect the computer name and username and include them in payload URLs. Employs C++ and C# downloaders to collect the computer name and username and transmit them to the C2 server via URL parameters and HTTP headers, respectively
Lateral Movement	Remote Services: SMB/Windows Admin Shares	Uses the Mythic implant that, upon receiving the `net_connection_add` command, connects to a network resource via WNetAddConnection2W with provided credentials and resource path
Collection	Archive Collected Data: Archive via Library	Uses Costura‑integrated `ICSharpCode.SharpZipLib` to archive data collected by PaperGrabber into ZIP files
	Data from Local System	Employs PaperGrabber to collect files from the compromised system, including user directories, the Recycle Bin, and local drives
	Data from Network Shared Drive	Employs PaperGrabber to exfiltrate a list of available network resources (including mounted network drives and shortcuts) and subsequently collect files from these resources based on predefined extensions
	Data from Removable Media	Employs PaperGrabber to gather information from connected removable media and files stored on them
	Input Capture: Keylogging	Uses the Mythic implant that, upon receiving the `keylogger` command, reads keylogger data from a named pipe associated with a third‑party component downloaded from the C2 server
	Screen Capture	Uses the Mythic implant that, upon receiving the screenshot command, captures `screenshots` with optional resolution parameters `(x` and `y)` provided by the C2 server
Command and Control	Application Layer Protocol: Web Protocols	Communicates with the C2 server over HTTPS in EchoGather and the Mythic implant. Uses HTTPS to load data collected by PaperGrabber to the C2 server. Uses HTTPS to download the malicious payload from the C2 server
	Data Encoding: Standard Encoding	Uses Base64 in EchoGather to encode data before sending it to the C2 server
	Encrypted Channel: Asymmetric Cryptography	Leverages SSL/TLS in EchoGather to encrypt C2 communication
	Ingress Tool Transfer	Uses EchoGather to load files to the compromised host upon command from the C2 server. Uses the `vain1` JS code to download shellcode from the C2 server via HTTPS GET requests in an infinite loop, retrying every 43–57 seconds until successful retrieval. Employs the C++ downloader to fetch shellcode from the C2 server via HTTPS GET requests, embedding the username and computer name in URLs. Employs the C# downloader to continuously send HTTPS GET requests (30‑second intervals) to retrieve a .NET assembly, passing the computer name and username in X‑Machine‑Name and X‑User‑Name headers
	Proxy: Internal Proxy	Uses the Mythic implant that, upon receiving the `socks` command, establishes a SOCKS proxy connection
Exfiltration	Automated Exfiltration	Employs PaperGrabber to automatically exfiltrate collected data to the C2 server
	Data Transfer Size Limits	Transmits collected data to the C2 server in 10 MB chunks
	Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non‑C2 Protocol	Uses PaperGrabber to load collected files, Telegram and browser data to the C2 server over HTTPS
	Exfiltration Over C2 Channel	Uses EchoGather to load files from the compromised host to the C2 server upon command. Employs the Mythic implant to exfiltrate system information, command execution results, file contents, and screenshots to the C2 server
	Exfiltration Over Web Service	Uses PaperGrabber to exfiltrate data via the Telegram API, including malware activity logs, computer name, and username

Tinker Tailor Soldier: Paper Werewolf’s latest toolkit

Overview

Key findings

EchoGather RAT phishing emails

PaperGrabber stealer

JS shellcode downloader

Custom‑built Mythic implant with loaders

C++ shellcode downloader

.NET assembly downloader

Indicators of compromise

Checksums

Network indicators

MITRE ATT&CK