New CoreRAT Malware Grants Full Control to Core Werewolf Hackers

Key Takeaways

• The Core Werewolf threat group is deploying a new custom remote access trojan (RAT) named CoreRAT.
• CoreRAT grants attackers extensive control over compromised Windows systems, including data exfiltration and arbitrary command execution.
• Initial campaigns, observed between June and July 2026, primarily targeted Russia’s public sector and defense industry.
• The malware is delivered via Telegram phishing messages containing weaponized documents disguised as official government or military files.
• CoreRAT replaces the group’s prior use of legitimate remote access software, signaling a shift to more agile and evasive custom tooling.

Core Werewolf Unleashes CoreRAT, Escalating Threat to Russian Sectors

The Core Werewolf threat group has significantly upgraded its operational capabilities with the introduction of CoreRAT, a novel remote access trojan (RAT) designed to provide comprehensive control over infected Windows environments. This new malware marks a strategic evolution in the group’s arsenal, moving away from off-the-shelf tools to a bespoke solution.

Observed in active campaigns from June to July 2026, and with evidence suggesting activity since March, CoreRAT represents a notable expansion of Core Werewolf’s attack toolkit. The group’s focus appears to be on entities within Russia’s public sector and defense industries.

Sophisticated Delivery Mechanisms

The infection chain typically begins with sophisticated phishing messages distributed via Telegram. These messages leverage highly convincing lures, often presenting themselves as official military or government documents. When a target opens these seemingly legitimate attachments, a decoy PDF is displayed to mask the simultaneous, covert installation of the CoreRAT malware.

Analysts at BI.ZONE said in a report that they identified this previously undocumented tool. Its deployment signifies a critical shift from Core Werewolf’s earlier reliance on legitimate remote access software, such as UltraVNC. The adoption of custom malware like CoreRAT offers the attackers greater flexibility, allowing for rapid modifications, enhanced stealth, and tailored functionality to suit their evolving objectives.

The delivery mechanisms employed by Core Werewolf include self-extracting 7z archives and a Rust-based dropper. Both methods are engineered to plant the CoreRAT payload alongside a benign decoy, ensuring the initial phase of the attack appears innocuous to the victim.

CoreRAT’s Advanced Functionality

CoreRAT, engineered in C++, incorporates robust obfuscation techniques, including the encryption of its internal text strings and command-and-control (C2) server addresses. A key feature of the malware is its anti-analysis capability: prior to execution, it actively scans for indicators of virtual test environments, such as system details, recent shortcut activity, and network adapter identifiers. If it detects a sandbox or virtual machine, CoreRAT terminates, preventing its behavior from being analyzed by researchers.

Upon successful execution on a legitimate target, CoreRAT initiates a reconnaissance phase, collecting critical system information. This includes the computer name, BIOS data, a list of running processes, desktop files, and network adapter details. This collected intelligence is then encoded, packaged, and exfiltrated over HTTPS to the group’s C2 server, providing the operators with an initial assessment of the compromised system’s value and potential for further exploitation.

The capabilities of CoreRAT extend beyond initial data collection. It can enumerate directories, inspect active processes, gather network configuration and ARP table data, and scrutinize active TCP connections. Furthermore, the RAT possesses the ability to execute arbitrary commands or processes, download and decrypt additional malicious files, and launch them. This comprehensive functionality transforms a successful infection into a launchpad for data theft, prolonged surveillance, or broader network intrusions.

CoreRAT also includes a self-deletion routine, designed to erase its presence after completing specified tasks. This process involves renaming the executable, creating a temporary batch file, and then deleting both components. This evasive tactic, coupled with encrypted configuration data, underscores the critical need for rapid incident response, forensic log preservation, and swift evidence collection during a suspected compromise.

Phishing Lures and Evasion Tactics

The 7z-based delivery chain strategically places a decoy PDF and the CoreRAT executable into distinct user directories before simultaneously opening both files. The Rust-based dropper unpacks a ZIP archive into a temporary directory, displays a decoy document, and employs a “ping” command to introduce a delay before executing the malware. This technique mirrors tactics seen in other campaigns, such as the MostereRAT Windows RAT, where seemingly harmless documents conceal remote access infections.

Researchers investigating the campaign noted several irregularities in the decoy documents, including unusual phrasing for official communications, evidence of document editing, and forged signatures. One particular PDF bore similarities to a file previously used by the Vortex Werewolf group, though insufficient evidence prevented a definitive link to shared infrastructure or group affiliation. These inconsistencies are often subtle, designed specifically to bypass casual scrutiny and lower a recipient’s guard.

What You Should Do

• Enhance Email and Messaging Security: Implement advanced threat protection solutions that scan incoming messages for malicious attachments and suspicious links, particularly on platforms like Telegram.
• Strengthen User Awareness Training: Conduct regular training sessions to educate employees about phishing tactics, the dangers of opening unexpected attachments, and how to identify forged documents or unusual phrasing.
• Implement Endpoint Detection and Response (EDR): Deploy EDR solutions to monitor endpoints for suspicious file names, hashes, and unexplained outbound HTTPS traffic, enabling rapid detection and response to potential compromises.
• Block Known Indicators of Compromise (IoCs): Integrate the provided SHA-256 and MD5 hashes, as well as the C2 domains and IP addresses, into your security information and event management (SIEM) systems, firewalls, and endpoint protection platforms to block known malicious entities.
• Isolate and Contain: In the event of a suspected compromise, immediately isolate affected devices from the network, reset potentially exposed credentials, and perform a thorough review of adjacent hosts for similar indicators of compromise.
• Preserve Forensic Evidence: Ensure that all logs and artifacts are quickly collected and preserved for detailed analysis following any suspected incident to understand the full scope of the breach and improve future defenses.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re