Sticky Werewolf Expands Cyber Attack Targets in Russia and Belarus

Researchers disclosed that the 'Sticky Werewolf' threat actor has conducted phishing campaigns against organizations in Russia and Belarus (pharmaceutical, microbiology/vaccine research, aviation), using RAR archives with LNK files that launch binaries from WebDAV servers; the chain includes NSIS-packed executables, AutoIt scripts and crypter variants to bypass defenses and deploy RATs and info-stealers (e.g., Rhadamanthys, Ozone). The report also references related clusters (Sapphire Werewolf, Fluffy Wolf, Mysterious Werewolf) employing additional malware and backdoors such as Amethyst/SapphireStealer and RingSpy, while attribution remains uncertain.