From Invoice to AnyDesk: Uncovering a Phishing Campaign Targeting  Russian Aerospace Organizations  

This report analyzes a targeted spear-phishing campaign that impersonates a Russian research institute to deliver a password-protected archive which, when executed, drops a Delphi-compiled installer that extracts and deploys portable AnyDesk, Blat (SMTP utility), Tray Minimizer and other components to configure unattended remote access, exfiltrate AnyDesk configuration via SMTP, and create scheduled-task persistence; the activity is attributed with moderate confidence to the Rare Werewolf (Librarian Ghouls) cluster and includes IOCs and MITRE ATT&CK mappings.