Researchers warn about ‘Goffee’ spilling onto Russian flash drives

Kaspersky and BI.ZONE report that an APT tracked as Goffee (aka Paper Werewolf) has deployed a custom backdoor, PowerModul, and associated modules (FlashFileGrabber, USB Worm) to exfiltrate files from USB flash drives and spread via removable media; the group has targeted Russian media, telecoms, government, construction, and energy organizations since at least 2022, delivering malware via phishing emails with malicious archives and impersonated institutions.