Paper Werewolf Unleashed: Custom Stealers and AI-Assisted Loaders Target Global Industrial Hubs

Paper Werewolf, a technically sophisticated threat actor, conducted an espionage campaign in March–April 2026 targeting Russian industrial, financial, and transport sectors using custom tools (PaperGrabber stealer, EchoGather RAT, Mythic implants), social-engineered phishing PDFs that deploy Inno Setup installers, and loaders in C++, C#, Python and JavaScript to stealthily exfiltrate high-value assets such as SSH keys and private cryptographic keys.