Cyber spies use fake New Year concert invites to target Russian military

Goffee (Paper Werewolf) has run a targeted campaign against Russian military and defense-industry organizations using malicious Excel XLL files that drop a new backdoor called EchoGather; the malware collects system information, executes commands, and exfiltrates data to a C2 server disguised as a food-delivery website. Phishing lures in Russian (including AI-generated documents and forged official letters) were used to entice victims, and researchers note prior Goffee activity involving USB-stealer malware and exploitation of a WinRAR zero-day, though the group's tradecraft still shows linguistic and technical gaps.