Attackers Exfiltrate AnyDesk Configuration Data via Blat SMTP in Aerospace Phishing Campaign

**Executive summary:** A targeted spear-phishing campaign impersonating an aerospace research institute sends password-protected RAR attachments that deploy a multi-stage dropper which installs a portable AnyDesk, configures unattended access and persistence (scheduled task “Auto apdate”), and exfiltrates AnyDesk configuration and credential artifacts via Blat SMTP; the report includes IOCs (hashes, IPs, domains), links the activity to the Rare Werewolf cluster, and recommends blocking abused tooling, inspecting password-protected attachments, monitoring AnyDesk artifacts and outbound SMTP, and applying application allowlisting and stronger email authentication.