Core Werewolf Deploys New CoreRAT Malware Against Russian Targets

BI.ZONE observed a mid-2026 campaign attributed to the suspected Core Werewolf cluster that delivered a custom remote access trojan, CoreRAT, via 7zSFX and Rust droppers sent primarily through Telegram phishing; the trojan performs reconnaissance, hides strings with AES, checks for sandboxes/VMs, beacons to HTTPS C2, and enables remote file/command operations, with recommended mitigations including blocking untrusted attachments and monitoring Links/Temp folders.