Eagle Werewolf

Eagle Werewolf is a cyberespionage threat cluster active since at least May 2023. It primarily targets government and industrial organizations, including defense organizations involved in unmanned aerial vehicle development and manufacturing, as well as individuals engaged in drone production and engineering. Its country of origin and state sponsorship have not been established. The cluster uses targeted phishing and compromised Telegram channels to distribute malware through Starlink registration and drone-related lures. In February 2026, it compromised a drone-focused Telegram channel and distributed a malicious application masquerading as a Starlink activation checklist. The infection chain used a Rust dropper built with the Tauri framework to decrypt and execute an embedded Go dropper while presenting a decoy interface and collecting host identifiers and Starlink-related information. Eagle Werewolf deploys AquilaRAT, a Rust-based remote access trojan supporting PowerShell command execution, file enumeration, and file exfiltration. It installs the malware as a Windows service for persistent access. Its deployment scripts create hidden local accounts and attempt to add them to the local Administrators group. The cluster also uses Go2Tunnel to establish reverse SSH tunnels, configuring public-key access for existing and newly created accounts. These mechanisms provide persistent remote control and access to compromised systems.