Core Werewolf hones its arsenal against Russia’s government organizations

Adversaries experiment with new tools and malware delivery methods

Tactic	Technique	Procedure
Execution	Command and Scripting Interpreter: Windows Command Shell	Core Werewolf uses `cmd.exe` to open a decoy document and run the AutoIt interpreter with the AutoIt script
	Command and Scripting Interpreter: AutoHotKey & AutoIT	Core Werewolf uses the AutoIt loader to download and execute the next stage AutoIt script
Defense Evasion	Indicator Removal: File Deletion	Core Werewolf deletes the files created and downloaded during the AutoIt loader’s execution
	Masquerading	Core Werewolf uses names similar to the document titles in the self‑extracting archives. Core Werewolf uses the Adobe Acrobat Reader icon in the self‑extracting archives
	Obfuscated Files or Information	Core Werewolf obfuscates the AutoIt loader's code
Discovery	File and Directory Discovery	Core Werewolf retrieves the list of files and folders in the `Desktop` directory
	System Information Discovery	Core Werewolf retrieves the computer name and OS version
	System Owner/User Discovery	Core Werewolf retrieves the username of the compromised system
Command and Control	Application Layer Protocol: Web Protocols	Core Werewolf uses HTTP to communicate with the C2 server. Core Werewolf employs a POST request to send the compromised host’s telemetry to the C2 server
	Ingress Tool Transfer	Core Werewolf uses the AutoIt loader to download the next stage AutoIt script and run it