Loading threat actor…
Versatile Werewolf is an espionage-oriented threat cluster associated with malware campaigns themed around Starlink terminal management tools and drone pilot training software. The actor has targeted government organizations, military personnel, and individuals involved in drone manufacturing and engineering, indicating a focus on state and defense-adjacent intelligence collection. The cluster is known for distributing malicious MSI installers masquerading as legitimate applications, including fake Starlink-related utilities and UAV training software. Its intrusion chains use multiple staged components, including PowerShell, VBScript, .NET loaders, and JavaScript, to deploy payloads while blending into normal Windows activity. One documented tradecraft pattern abuses the legitimate Windows utility Fondue.exe to side-load a malicious APPWIZ.cpl file, resulting in in-memory deployment of a Sliver implant. This provides remote command execution and post-compromise access, and is paired with persistence through scheduled tasks designed to resemble legitimate Microsoft update activity. Versatile Werewolf has also deployed SoullessRAT, a JavaScript-based remote access trojan reportedly developed with assistance from generative AI. SoullessRAT supports command execution, file transfer, screenshot capture, Outlook data harvesting, directory and volume enumeration, and broader host reconnaissance. Across observed campaigns, the actor has demonstrated defense evasion through use of trusted binaries, side-loading, obfuscation, and packed components, as well as persistence and post-exploitation capability through implants and scheduled task creation. Known lures and infrastructure themes include StarDebug and AlphaFly. The cluster has been tracked distinctly from other similarly named Werewolf clusters such as Paper Werewolf and Eagle Werewolf.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
26 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
2 malware families Mallory has associated with this actor across public reporting.
20 indicators attributed to this actor. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.