Loading story…
BI.ZONE Threat Intelligence reported that the Fluffy Wolf cluster, also tracked as Watch Wolf, launched a new campaign against Russian companies in construction, consulting, engineering, retail, e-commerce, and industrial sectors. The attackers used phishing emails disguised as financial claims or debt-collection notices from partners or contractors, delivering malicious archives either directly or through GitHub links to make the messages appear legitimate and improve delivery past email filters.
The campaign deployed a multi-stage malware chain that included a new C++ loader dubbed PowerLoader, which starts hidden PowerShell, retrieves scripts from a command server, and downloads PureCrypter to install final payloads. BI.ZONE said the operators used PureLogs for credential and data theft, a new PureRAT variant with the PluginRemoteDesktop module for remote access, and in at least one case deployed Pay2Key ransomware based on Mimic; researchers added that much of the toolset appears to have been sourced through malware-as-a-service offerings.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
BI.ZONE said at least one incident in the campaign involved deployment of Pay2Key ransomware based on Mimic. This marked an escalation from credential theft and remote access tooling to ransomware impact in at least one case.
Researchers reported that Fluffy Wolf was using a new version of PureRAT that includes the PluginRemoteDesktop module. BI.ZONE also said the group continued using PureLogs to steal credentials and other data.
BI.ZONE observed a new C++ loader dubbed PowerLoader in Fluffy Wolf operations. It launches hidden PowerShell, retrieves scripts from a command server, and downloads PureCrypter to deliver the final payload.
In the campaign, phishing emails delivered malicious archives either directly or through GitHub links, a technique researchers said helped the attackers appear legitimate and evade email filtering. The archives contained loaders and droppers used to deploy PureLogs, PureRAT, and Pay2Key ransomware.
BI.ZONE Threat Intelligence reported that Fluffy Wolf conducted attacks against Russian organizations in construction, consulting, engineering, retail, e-commerce, and industrial sectors between March and May 2026. The campaign used phishing emails posing as financial claims or debt-collection notices from partners or contractors.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Sticky Werewolf** cyber-espionage group has been linked to phishing attacks against Russian scientific, industrial, and government organizations, with later reporting also identifying targets in Belarus. In one campaign, attackers impersonated Russia’s Ministry of Industry and Trade in emails carrying decoy documents and a password-protected archive; another wave used phishing links generated through **IP Logger** to disguise delivery URLs while collecting victim profiling data such as IP address, location, browser version, and operating system. Researchers also tied the activity to earlier spoofed-email operations themed around Russian state bodies including **EMERCOM**, the Ministry of Construction, and the **FSB**. The intrusions ultimately deployed **Ozone RAT**, and in some cases **Darktrack RAT**, while showing victims decoy files to mask the infection. Analysts said the Ozone RAT loader was copied into `%TEMP%` under names such as `utorrent.exe`, established persistence through a shortcut in the Windows Startup folder, and used a modular chain in which it downloaded an encrypted DLL from a command-and-control server, saved it as `data.dbf`, decrypted it, and loaded it reflectively into memory via the Delphi API function **BTMemoryModule**. The malware was reported to support remote command execution, file and process management, registry changes, keylogging, screen, webcam, and microphone capture, password theft from browsers and mail clients, hidden virtual network computing (**HVNC**) control, reverse proxying, payload delivery, and self-deletion.
Aug 15, 2026
Kaspersky reported that the threat actor **Bloody Wolf**—tracked by the vendor as **Stan Ghouls**—is running a spear-phishing campaign primarily targeting organizations in **Uzbekistan** and **Russia**, with additional, lower-volume activity observed in other countries. The activity, ongoing since at least 2023, has targeted sectors including manufacturing, finance, and IT, and has also been observed hitting government, logistics, healthcare, and education entities. Reported victim counts for the current wave are on the order of **50+ in Uzbekistan** and **~10 in Russia**, with the actor assessed as likely financially motivated, though the heavy use of remote-access tooling may also support espionage objectives. The intrusion chain relies on phishing emails carrying **malicious PDF lures** (e.g., court/government-themed documents) that embed links leading to a downloader/loader, after which the actor deploys **NetSupport RAT** (a legitimate remote administration tool) for remote control—representing a shift from prior use of **STRRAT**. Kaspersky noted the loader’s behavior includes user-deception (fake error messages) and basic execution controls (e.g., limiting repeated installation attempts), while another reported lure uses a social-engineering pretext that victims must install a **Java Runtime Environment update**, ultimately delivering a **malicious JAR**—a technique Kaspersky described as a distinctive fingerprint for this actor. Prior related reporting cited phishing activity in Kyrgyzstan distributing similar tooling, indicating a broader regional focus beyond the current Uzbekistan/Russia emphasis.
Jun 29, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026