EchoGather
EchoGather is a remote access trojan/backdoor associated with the Paper Werewolf (also known as GOFFEE/Goffee) cluster and used in espionage campaigns targeting Russian organizations, including military, defense-industry, and related entities. It has been distributed through multiple delivery chains, including C# droppers masquerading as Starlink restriction-bypass or registration tools and BattleFlight UAV/drone training simulator installers, as well as a malicious Excel XLL add-in campaign. In the Starlink-themed campaign, the payload was Base64-encoded and XOR-encrypted, saved as %APPDATA%\Microsoft\Windows\mssw.exe, and executed by the dropper; in the BattleFlight campaign it was saved as %APPDATA%\Microsoft\Windows\msms.exe; in the XLL campaign, the loader dropped mswp.exe into %APPDATA%\Microsoft\Windows and launched it hidden. The XLL loader triggered malicious execution from DllMain on DLL_THREAD_DETACH rather than standard XLL exports.
EchoGather performs host reconnaissance and anti-analysis checks. Reported anti-VM/anti-sandbox behavior includes hostname comparison, timing checks using QueryPerformanceFrequency and QueryPerformanceCounter, sleep validation with GetTickCount64 and NtDelayExecution, disk-size checks, and executable-name-length checks. It collects system information including local/private IPv4 addresses, OS type, architecture, computer or NetBIOS name, username, workstation/domain configuration, current process ID, executable path, and in one sample a static version string of 1.1.1.1.
The malware communicates with hardcoded command-and-control infrastructure over HTTP(S), using POST requests and Base64-encoded data. Reported C2s include syncheaven[.]online with path sync/now/ru/moscow/fetch, certcheck[.]online with a certificate-themed API path, and fast-eda[.]my:443 with a long food-delivery-themed path. It uses WinHTTP, supports proxy configuration, and in the XLL-reported sample ignores SSL/TLS certificate validation errors. Beaconing has been described as an infinite loop with randomized sleep intervals of 300-360 seconds.
EchoGather supports remote command execution and file transfer. Documented command functionality includes updating sleep/beacon delay, executing commands via cmd.exe, uploading files/exfiltration, and downloading or remotely writing files. One BattleFlight-linked variant reportedly lacked command 0x57 for downloading files from C2 to the host.
Known indicators directly mentioned in the content include dropped filenames mssw.exe, msms.exe, and mswp.exe under %APPDATA%\Microsoft\Windows; C2 domains syncheaven[.]online, certcheck[.]online, and fast-eda[.]my; and sample SHA-256 hashes 74fab6adc77307ef9767e710d97c885352763e68518b2109d860bb45e9d0a8eb for an EchoGather payload and 0506a6fcee0d4bf731f1825484582180978995a8f9b84fc59b6e631f720915da for an XLL loader carrying EchoGather.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
As in the other campaign, the C# dropper contains the EchoGather payload, which is Base64-encoded and XOR-encrypted... The EchoGather RAT is launched during the BattleFlight installation.
Techniques & procedures
14 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 techniqueNotably, in February 2026, it compromised one of the drone-focused Telegram channels to distribute malware.
Execution
3 techniquesUpon execution, StarDebug_1.0.1.msi creates the directory %LOCALAPPDATA%\Star and extracts the following three files to it...
The URL hxxps://battleflight[.]org/download/installer hosted the executable BattleFlight-Install-v11.0.3.exe, a C# dropper disguised as an installer for a drone pilot training simulator.
Stealth
6 techniquesThe appwiz.cpl applet is packed with UPX and obfuscated with Oreans Code Virtualizer.
The dropper contains the EchoGather payload, which is Base64-encoded and XOR-encrypted.
BattleFlight-Install-v11.0.3.exe, a C# dropper disguised as an installer for a drone pilot training simulator.
the C# dropper contains the EchoGather payload, which is Base64-encoded and XOR-encrypted.
Discovery
3 techniquesEchoGather performs anti-virtualization checks, gathers system information, uploads it to the C2 server...
Command and Control
2 techniques0x57 Download a file from the C2 server to the host ... The obfuscated JS script is a loader used to gain a foothold in the compromised system and download the malware
Exfiltration
1 techniqueThe payload then enters an endless loop in which it connects to the C2 server, encodes the system information in Base64, and exfiltrates it via an HTTPS POST query.
IOCs tracked for this family
15 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote access trojan delivered via C# droppers disguised as Starlink registration and drone training software. It performs anti-virtualization checks, gathers host information, exfiltrates it to a C2 over HTTPS POST, and supports commands to change beacon delay, execute cmd.exe commands, upload files, and download files.
A remote access trojan delivered by a C# dropper disguised as a BattleFlight installer. It performs anti-virtualization checks, gathers system information, uploads it to a C2 server, and waits for commands.
Remote access trojan delivered via C# droppers masquerading as Starlink registration and UAV training software. It performs anti-VM checks, collects host/system information, communicates with HTTPS C2, and supports command execution plus file upload/download.
EchoGather is a backdoor used for cyberespionage, enabling attackers to collect system information, execute commands, and transfer files from compromised systems.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.