SilentWerewolf Attack Leverages Legitimate Utilities and Malware Obfuscation to Remain Hidden

The sophisticated espionage campaign attributed to the SilentWerewolf APT group has demonstrated advanced technical tradecraft, leveraging legitimate Windows utilities, intricate obfuscation methods, and custom malware loaders to maximize evasion and remain undetected within targeted environments across Russia and Moldova.

Beginning in March 2025, adversaries linked to SilentWerewolf have orchestrated highly targeted spearphishing attacks against industries such as energy (specifically nuclear), aerospace, and engineering, as well as government and enterprise IT infrastructure.

Attack Vector

The initial compromise in both reported campaigns occurs via phishing emails, where recipients are enticed to download ZIP archives under the guise of official correspondence including pre-action legal letters, construction project documentation, vacation schedules, or ransomware guidance.

These ZIP packages contain a malicious LNK file alongside nested archives. The LNK file executes a complex command sequence that systematically extracts further components, using Windows-native tools such as cmd.exe, powershell.exe, and forfiles.exe.

Notably, the attackers exploit legitimate, signed Microsoft executables such as DeviceMetadataWizard.exe for DLL side-loading, enabling the C# loader (packed as d3d9.dll) to be executed in a trusted context.

Loader Functionality

The deployed C# loader features multiple layers of obfuscation strings are encoded with Base64 and further encrypted with per-instance XOR keys, while the loader binaries themselves are obfuscated with tools like Obfuscar.

Task automation, persistence, and payload delivery are orchestrated through a combination of PowerShell scripts, MSBuild tasks, and batch files placed in the Windows startup directory.

To evade static and dynamic analysis, the malware employs several anti-analysis measures:

• Environmental checks for usernames, machine names, and processor counts are used to evade sandboxes.
• In inconclusive environments, instead of the actual payload, the loader may download innocuous large files such as Llama 2 language model binaries.
• Decoy PDF files are deployed to maintain the appearance of legitimacy and distract targets from suspicious activity.

The loader’s configuration is delivered either as a nested ZIP or an encrypted configuration blob (config.bin) containing encoded batch commands, encrypted payloads, and decoy documents.

According to the Report, the batch commands extract necessary files, invoke MSBuild to compile and run C# tasks on-the-fly, and establish persistence mechanisms.

The loader ultimately downloads the actual malicious payload from hardcoded C2 domains over HTTPS, decrypts it, and executes it ensuring that every stage is obfuscated and interleaved with use of trusted system binaries to blend in with normal activity.

SilentWerewolf’s operations exhibit a wide range of MITRE ATT&CK techniques, including spearphishing links, DLL hijacking, powershell and cmd execution, MSBuild proxy execution, boot persistence, and a substantial emphasis on layered obfuscation and anti-forensic tactics.

Indicators of Compromise

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.