Paper Werewolf targets Russia with WinRAR zero‑day vulnerability
In July 2025, BI.ZONE Threat Intelligence uncovered a series of attacks carried out by the Paper Werewolf (GOFFEE) cluster. The threat actor exploited the directory traversal RCE vulnerability in WinRAR (CVE‑2025‑6218) along with a similar zero‑day vulnerability that had not yet been assigned a CVE identifier at the time of this research.
- Cyber spies continue to demonstrate strong capabilities in bypassing defenses, enhancing their toolkits to successfully exploit vulnerabilities, particularly zero days.
- Malware delivered through archive files is more likely to evade email security filters as such attachments are common in legitimate correspondence.
- Despite their advanced skills, attackers still rely on a wide range of easily detectable tactics, techniques, and procedures (TTPs). Therefore, 24/7 incident monitoring remains essential for effective corporate defense.
In early July, BI.ZONE Threat Intelligence identified a targeted phishing campaign carried out by Paper Werewolf. The adversaries impersonated a Russian R&D institute representative and attached a letter purportedly from a government ministry. Notably, the phishing emails were sent from a compromised account of a legitimate furniture supplier.
To determine whether a victim opened their phishing email, the attackers embedded a link to a hidden 1×1 pixel image within the message’s HTML code.
The email contained the RAR file minprom_04072025.rar which exploited CVE‑2025‑6218. This WinRAR vulnerability allows a malicious archive to extract and save files outside the intended target directory—including the startup folder—enabling code execution during the login process.
minprom_04072025.rar
Extracting the archive on a victim computer creates a malicious executable in the startup folder: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\xpsrchvw74.exe. Additionally, the directory %SYSTEMDRIVE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup is created which contains the following identical executable files: xpsrchvw71.exe, xpsrchvw72.exe, and xpsrchvw73.exe.
The contents of decoy files contained in the RAR archive are shown below.
письмо на СМ_(файл отображения).pdf (mapping file)
Шаблон_запроса (7) (11).docx (request template)
xpsrchvw74.exe
The xpsrchvw74.exe file is a modified XPS Viewer (version 6.1.7600.16385). The threat actors embedded malicious shellcode (a reverse shell) into the executable. The shellcode connects to the C2 server 89.110.88[.]155:8090, thus providing remote access to the cmd.exe shell on a victim computer. It is noteworthy that the executable uses ROR13 hashing to obfuscate WinAPI function names.
Attack dated 2025‑07‑22
In another Paper Werewolf attack, BI.ZONE Threat Intelligence discovered the malicious RAR Запрос_Минпромторг_22.07.rar (request from the Russian Ministry of Industry and Trade), which exploits a previously unknown zero‑day directory traversal vulnerability in WinRAR.
The flaw stems from the archiver’s ability to include files with alternative data streams (ADS) which can contain arbitrary payloads. When an archive is extracted or a file is opened directly from within it, the data from ADS is written to arbitrary system directories, enabling a directory traversal attack. This vulnerability affects WinRAR versions up to and including 7.12 and is no longer reproducible starting from version 7.13.
Запрос_Минпромторг_22.07.rar
Upon opening the decoy запрос Минпромторга РФ.pdf or extracting the RAR contents, the following files are created on a victim computer:
%LOCALAPPDATA%\WinRunApp.exe%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\WinRunApp.lnk
The contents of the decoy embedded in Запрос_Минпромторг_22.07.rar are shown below.
запрос Минпромторга РФ.pdf
It is worth mentioning that BI.ZONE Threat Intelligence discovered an underground forum post offering an allegedly functional WinRAR zero‑day exploit for $80,000. While the post did not mention CVE‑2025‑6218, it is possible that the exploit offered for sale was related to the vulnerability we identified—and that Paper Werewolf may have purchased and adapted it for their attacks.
WinRunApp.exe
The WinRunApp.exe executable is a malicious .NET application coded in C#. This is a loader that retrieves a payload (a .NET assembly) from the C2 server and runs it in memory. The payload itself was not available at the time of this research.
Once executed, the loader tries to create a mutex. If this fails, it terminates. The mutex used in the attack is Sfgjh824nf6sdfgsfwe6467jkgg3vvvv3q7657fj436jh54HGFa56.
Then the loader enters an endless loop, repeatedly attempting to download the payload from the C2 server. If a C2 response is not zero‑length, the loop terminates. Otherwise, the loader goes to sleep for a while (in this case, for 331 seconds) and then tries again.
The loader also retrieves a computer name and username, then appends them to a URL sent to the C2 server to fetch the payload.
Such URL may look as follows:
hxxps://IndoorVisions[.]org/patriarchal/furthering/creating/flared/censured?hostname=[computer_name]&username=[username]
To access the C2 server, the loader uses the following User‑Agent header strings: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 Edg/91.0.864.59.
The payload is a .NET assembly loaded into process memory via Assembly.Load and executed with the Invoke method. The payload is executed with a specific class and method defined in the loader configuration data. Here, these are the class EatLanguageSubject.AnswerEndSight and the method PainGroupStep.
Attacks dated 2025‑07‑31 and 2025‑08‑01
During these attacks, the adversaries also used malicious RAR files with the above zero‑day vulnerability. This time, BI.ZONE Threat Intelligence discovered the archives named DON_AVIA_TRANS_RU.rar and DON_AVIA_TRANS_UZ.rar which included the following files: three PDF documents, one text file disguised as a PDF, and—embedded in ADS—an LNK file and a C# loader executable.
DON_AVIA_TRANS_RU.rar
DON_AVIA_TRANS_UZ.rar
In this case, the threat actors included ADS into every file within the archives. If a user opens any of the decoys or extracts the RAR contents, files similar to those observed in the previous attack will be created on a victim computer.
Sample contents of the decoys Бриф компании.pdf (company brief) and Hamkorlik bo‘yicha aniqlashtiruvchisavollarga javoblar.pdf are shown below.
Бриф компании.pdf
Hamkorlik bo‘yicha aniqlashtiruvchi savollarga javoblar.pdf
The files Презентация.pdf and Presentation.pdf are identical (have the same checksum) and contain text data demonstrated below.
Презентация.pdf (Presentation.pdf)
WinRunApp.exe
WinRunApp.exe is functionally nearly identical to the C# loader analyzed in the 2025‑07‑22 attack, except for the additional code that launches the file, if it exists within the system. The name of this file is not specified in the configuration data of the analyzed sample.
Loader configuration data
| Mutex |
Global_22576733 |
| Payload (class) |
HomeFunctionMarket.MomentSingKnow |
| Payload (class method) |
EffectTeacherLeave |
| URL |
|
| User-Agent |
|
| File name in the system |
"" |
| Sleep interval, seconds |
330 |
minprom_04072025.rar
MD5: 9a69b948e261363463da38bdbf828b14
SHA1: 40e647d61a00fd7240e54dba45ce95c5d33cae43
SHA256: fe2587dd8d9755b7b3a106b6e46519a1ce0a8191eb20821d2f957326dbf912e9
xpsrchvw.exe
MD5: 942220fc9382f44ae82061d1fc63f41e
SHA1: 7ff3d32e78c5626135a73bba4a011058f714ae86
SHA256: bf74820d40d281c28d5928b01e5b68d6caf85b5b9188bf4efb627765d708bcff
hxxps://eliteheirs[.]org/checks/brandished/dyestuffs/abbess/interrelation?4eab27f5266393a1150e7d6453c1920db480c2f88ce96708cff593e38ae8ac30
hxxps://eliteheirs[.]org/checks/brandished/dyestuffs/abbess/interrelation
hxxps://eliteheirs[.]org/crossness/outpost/autocracies/decapitations/jetsetting?b115ef3ad9cb948213f7efc4876cf67747eac173b613b425abd05dba0e306ebd
hxxps://eliteheirs[.]org/crossness/outpost/autocracies/decapitations/jetsetting
eliteheirs[.]org
89.110.88[.]155:8090
81.30.105[.]148
213.171.4[.]200
Запрос_Минпромторг_22.07.rar
MD5: 6b4d7a63aa2a8b2a5a3fbad6c8e6533e
SHA1: d3820a1248bf54ce8a3d05bf688bcd97e1c41d8e
SHA256: 28a2b98ae214376ccd549a8b0dccafad31c8b234d0b81a0e8817579566615567
DON_AVIA_TRANS_UZ.rar
MD5: eaba94b5237d2625fa38bc924e5347c4
SHA1: 6c0e52b8ed746b5b8ebef1ef2226093260659ae8
SHA256: d2c3fe8b9a4e0e5b7bcc087d52295ab30dc25b1410f50de35470383528c9d844
WinRunApp.exe
MD5: 1670035385c9031f79566c6f73fb9743
SHA1: b7bba4a216f4910f5072019bb4a2022ccf098c75
SHA256: 2446f97c1884f70f97d68c2f22e8fc1b9b00e1559cd3ca540e8254749a693106
WinRunApp.exe
MD5: 67daddd8fd8a59c8b3d40ea433efd6ff
SHA1: 23708d1fdcd7ba65c2b2fc676cee707e746a2dd9
SHA256: 236aba76d427111e8c140604ead9c4ab86264b1ae197fc26fadb33c46be94289
hxxps://indoorvisions[.]org/patriarchal/furthering/creating/flared/censured?hostname=[hostname]&username=[username]
hxxps://indoorvisions[.]org/patriarchal/furthering/creating/flared/censured
hxxps://trailtastic[.]org/glowworms/diverted/calorie/britons/parabolas?hostname=[hostname]&username=[username]
hxxps://trailtastic[.]org/glowworms/diverted/calorie/britons/parabolas
indoorvisions[.]org
trailtastic[.]org
89.110.98[.]26
94.242.51[.]73
Mutexes:
Sfgjh824nf6sdfgsfwe6467jkgg3vvvv3q7657fj436jh54HGFa56Global_22576733
| Tactic | Technique | Procedure |
|---|---|---|
| Initial Access |
Phishing: Spearphishing Attachment |
Paper Werewolf uses phishing email attachments to distribute malware |
|
Phishing for Information: Spearphishing Link |
Paper Werewolf uses phishing emails that include elements like tracking pixels to determine whether a victim opened their message |
|
| Execution |
Command and Scripting Interpreter: Windows Command Shell |
Paper Werewolf employs reverse shell to remotely execute commands via the |
|
Exploitation for Client Execution |
Paper Werewolf exploits vulnerabilities in WinRAR (CVE‑2025‑6218 and an unregistered zero‑day) to create malicious files on a victim computer and add them to the startup folder |
|
|
User Execution: Malicious File |
The victim must unpack the malicious RAR archive or open the embedded PDF file to trigger the compromise |
|
| Persistence |
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
Through the WinRAR vulnerabilities, Paper Werewolf creates the following files in the startup folder: |
| Defense Evasion |
Hide Artifacts: Hidden Window |
Paper Werewolf employs a C# loader with an invisible window to conceal its user interface activity |
|
Obfuscated Files or Information: Dynamic API Resolution |
Paper Werewolf uses ROR13 hashing to obfuscate WinAPI function names in reverse shell |
|
|
Obfuscated Files or Information: Embedded Payloads |
Paper Werewolf leveraged a modified XPS Viewer version with an embedded reverse shell payload |
|
| Discovery |
System Information Discovery |
Paper Werewolf uses the C# loader to retrieve a victim computer’s name and send it in a URL to the C2 server to fetch the payload |
|
System Owner/User Discovery |
Paper Werewolf uses the C# loader to retrieve a username and send it in a URL to the C2 server to fetch the payload |
|
| Command and Control |
Application Layer Protocol: Web Protocols |
Paper Werewolf uses HTTPS in the C# loader to download an encrypted payload file from the C2 server |
|
Ingress Tool Transfer |
Paper Werewolf employs a custom C# loader to download malicious payload from the C2 server |
|
|
Non-Application Layer Protocol |
Paper Werewolf uses reverse shell sockets to communicate with the C2 server |
Building an effective cybersecurity strategy requires an understanding of the vulnerabilities that Paper Werewolf and similar threat actors may exploit in real attacks. For this purpose, we would recommend that you leverage the data from the BI.ZONE Threat Intelligence portal. It provides information about the current attacks, threat actors, their tactics, techniques, tools, and exploited vulnerabilities. This intelligence can help you stay proactive and accelerate your incident response.