New CoreRAT Malware Lets Core Werewolf Hackers Take Full Control of Compromised Systems

Core Werewolf is targeting Russia’s public-sector and defense organizations with a new custom remote access trojan called CoreRAT.

The malware gives operators broad control over infected Windows systems, allowing them to run commands, collect information, download payloads, and remove evidence after an operation.

The campaign appears tied to ongoing geopolitical tensions. Instead of relying on legitimate UltraVNC remote-access software, the threat group deployed its own C++-based RAT.

This change may help the attackers avoid security detections based on known remote-administration tools and shows an increase in their malware-development capability.

Core Werewolf previously used smaller custom backdoors, but CoreRAT is its first fully functional remote access trojan. Its feature set supports reconnaissance, command execution, file transfer, network discovery, and self-deletion.

CoreRAT Gives Werewolf Control

The attackers used phishing lures disguised as military, government, and administrative documents.

Several executable filenames were written in Russian and designed to resemble official correspondence, including refresher-training notices, passport-related files, and instructions.

Researchers identified two main delivery methods: 7z self-extracting archive (7zSFX) droppers and Rust-based droppers. Both methods contained a legitimate-looking PDF decoy alongside the CoreRAT payload.

The 7zSFX droppers copied the PDF to common user folders such as Desktop, Downloads, or Documents. At the same time, they placed CoreRAT in the user’s Links folder under filenames including Firepoin.exe, Baresl.exe, and LiteEdit.exe.

The dropper then launched the malware and decoy document, helping the infection appear normal to the victim. Rust droppers extracted a ZIP archive into the %TEMP% directory.

They displayed the decoy PDF, then delayed the malware launch using ping.exe commands before starting CoreRAT. This delay can complicate basic sandbox analysis.

The decoy PDFs contained signs of forgery, including unusual wording, editing artifacts, and fake signatures. One lure also resembled a PDF previously linked to Vortex Werewolf.

Researchers said this could suggest shared tools or infrastructure, but the available evidence does not confirm a direct connection between the groups.

CoreRAT encrypts its internal strings and command-and-control (C2) addresses with AES-CBC encryption. Before contacting its infrastructure, it checks for virtualized or analysis environments.

The malware uses CPUID checks for VMware, VirtualBox, Xen, and KVM indicators. It also examines BIOS registry values, checks recent Windows shortcut activity, and in some samples reviews network-adapter MAC address prefixes associated with virtualization platforms. If it detects a virtual machine or sandbox, it terminates.

After passing these checks, CoreRAT collects the device name, BIOS version, running processes, desktop files, network-adapter details, active TCP connections, and ARP-table information.

It packs this information into a JSON object, Base58-encodes it, and sends it to C2 servers through HTTPS POST requests, bi.zone said.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN