New CoreRAT Malware Empowers Core Werewolf Group with Full System Control
The Core Werewolf threat group is deploying a new C++ remote access trojan, CoreRAT, to gain complete control over compromised Windows systems, marking a significant upgrade to their toolkit.
The Core Werewolf threat group has introduced a new, sophisticated remote access trojan (RAT) named CoreRAT, significantly enhancing their capabilities to achieve full control over compromised Windows systems. First observed in campaigns between June and July 2026, with evidence suggesting activity as early as March, CoreRAT represents a substantial evolution in the group's arsenal, replacing their previous reliance on legitimate remote access software like UltraVNC.
This new malware was delivered through targeted phishing campaigns on Telegram, where attackers disguised malicious documents as official military or government files. Upon opening these attachments, victims would be presented with a decoy PDF file, while a hidden component silently installed CoreRAT in the background. BI.ZONE researchers identified this previously undocumented tool and noted that its custom nature allows for rapid adaptation, making it harder to detect and tailor to the attackers' specific objectives. CoreRAT is described as the group's first fully functional RAT, underscoring a strategic shift towards more potent and bespoke malware.
The CoreRAT malware is written in C++ and features robust obfuscation techniques, including the encryption of its internal text strings and command-and-control (C2) server addresses. Before executing its malicious payload, CoreRAT performs several checks to detect if it is running within a virtualized environment or analysis sandbox. It scrutinizes system details, recent shortcut activity, and network adapter identifiers. If it suspects it's being monitored, the malware is designed to shut down to prevent its behavior from being analyzed by security researchers.
On legitimate victim machines, CoreRAT systematically gathers critical system information. This includes the computer name, BIOS data, a list of running processes, accessible desktop files, and detailed network adapter information. This data is then packaged, encoded, and transmitted over HTTPS to the attackers' command server. This initial reconnaissance provides the threat actors with a comprehensive overview of the compromised system, helping them assess its potential value and plan subsequent stages of their attack, such as data exfiltration or further exploitation.
Beyond information gathering, CoreRAT possesses a range of functionalities to facilitate deeper compromise. It can enumerate directories, inspect active processes, collect network configuration details, and review active TCP connections. Furthermore, it has the capability to execute arbitrary commands or processes supplied by the operator, download and decrypt additional malicious files, and launch them. This versatility transforms a single infection into a potential gateway for extensive surveillance, data theft, or a broader network intrusion.
The delivery mechanism employed by Core Werewolf is also noteworthy. Researchers observed two primary delivery methods: a self-extracting 7z archive and a dropper written in Rust. Both methods were designed to plant a decoy document alongside the CoreRAT executable, aiming to create a façade of legitimacy and reduce immediate suspicion. The 7z-based chain copied the decoy PDF and the malware to different user folders before opening both, while the Rust version unpacked a ZIP archive, displayed the decoy, and used a delayed execution technique via a ping command.
To evade detection and analysis, CoreRAT includes a self-deletion routine. After completing its assigned tasks, the malware can erase itself from the compromised system. This process involves renaming the executable, creating a temporary batch file for the deletion command, and then removing both files. This, combined with its encrypted configuration data, highlights the importance of prompt evidence collection and log preservation for incident response teams investigating potential compromises.
The campaign's focus on Russia's public sector and defense industry, coupled with the use of familiar document lures, underscores the persistent threat posed by social engineering tactics. Organizations are advised to treat all unexpected document files, especially those resembling official notices and containing executable components, as potential threats. Implementing robust security measures, including blocking known indicators of compromise, monitoring endpoints for suspicious file activity, and scrutinizing outbound HTTPS traffic, is crucial for defense.