New CoreRAT Malware Lets Core Werewolf Hackers Take Full Control of Compromised Systems

Core Werewolf is targeting Russian public-sector and defense organizations with a new custom C++ remote access trojan called CoreRAT delivered via phishing using 7z self-extracting and Rust-based droppers that display decoy PDFs. CoreRAT performs extensive reconnaissance, command execution, file transfer, network discovery, anti-VM/sandbox checks, AES-CBC-encrypted strings and C2, and uses HTTPS POST to exfiltrate Base58-encoded JSON; the report includes defanged domain IOCs and notes increased attacker capability compared to prior backdoors.