Loading story…
The Sticky Werewolf cyber-espionage group has been linked to phishing attacks against Russian scientific, industrial, and government organizations, with later reporting also identifying targets in Belarus. In one campaign, attackers impersonated Russia’s Ministry of Industry and Trade in emails carrying decoy documents and a password-protected archive; another wave used phishing links generated through IP Logger to disguise delivery URLs while collecting victim profiling data such as IP address, location, browser version, and operating system. Researchers also tied the activity to earlier spoofed-email operations themed around Russian state bodies including EMERCOM, the Ministry of Construction, and the FSB.
The intrusions ultimately deployed Ozone RAT, and in some cases Darktrack RAT, while showing victims decoy files to mask the infection. Analysts said the Ozone RAT loader was copied into %TEMP% under names such as utorrent.exe, established persistence through a shortcut in the Windows Startup folder, and used a modular chain in which it downloaded an encrypted DLL from a command-and-control server, saved it as data.dbf, decrypted it, and loaded it reflectively into memory via the Delphi API function BTMemoryModule. The malware was reported to support remote command execution, file and process management, registry changes, keylogging, screen, webcam, and microphone capture, password theft from browsers and mail clients, hidden virtual network computing (HVNC) control, reverse proxying, payload delivery, and self-deletion.
Get the infrastructure and lures behind it.
8 events from the most recent confirmed update back to the earliest known activity.
On the evening of January 13, F.A.C.C.T. Managed XDR intercepted and blocked a phishing email spoofing Russia's Ministry of Industry and Trade. The message carried decoy documents and a password-protected archive that ultimately delivered Ozone RAT.
A phishing email dated December 23, 2024 targeted a scientific-production enterprise using the same Ministry of Industry and Trade-themed decoy documents later seen in January. The earlier message did not include the archive carrying the malware payload.
In January 2024, the group conducted another spoofed-email campaign using the FSB as a lure theme, continuing its pattern of targeting Russian organizations through phishing.
In December 2023, Sticky Werewolf twice targeted the Russian pharmaceutical sector with phishing emails impersonating EMERCOM and the Ministry of Construction, according to F.A.C.C.T.'s historical campaign tracking.
BI.ZONE disclosed that the Ozone RAT loader downloads an encrypted DLL main module from C2, saves it as data.dbf, decrypts it, and reflectively loads it into memory using the Delphi API function BTMemoryModule.
BI.ZONE described how Sticky Werewolf's Ozone RAT loader copied itself into %TEMP% under names like utorrent.exe and established persistence with a shortcut in the Windows Startup folder.
BI.ZONE reported a Sticky Werewolf intrusion method in which phishing emails used IP Logger-generated links to disguise malicious downloads and collect victim telemetry such as IP address, location, browser version, and operating system.
After analyzing the blocked email and malware chain, F.A.C.C.T. linked the activity to the pro-Ukrainian cyber-espionage group Sticky Werewolf based on the lure theme, delivery chain, and Ozone RAT sample.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026
Kaspersky reported that the threat actor **Bloody Wolf**—tracked by the vendor as **Stan Ghouls**—is running a spear-phishing campaign primarily targeting organizations in **Uzbekistan** and **Russia**, with additional, lower-volume activity observed in other countries. The activity, ongoing since at least 2023, has targeted sectors including manufacturing, finance, and IT, and has also been observed hitting government, logistics, healthcare, and education entities. Reported victim counts for the current wave are on the order of **50+ in Uzbekistan** and **~10 in Russia**, with the actor assessed as likely financially motivated, though the heavy use of remote-access tooling may also support espionage objectives. The intrusion chain relies on phishing emails carrying **malicious PDF lures** (e.g., court/government-themed documents) that embed links leading to a downloader/loader, after which the actor deploys **NetSupport RAT** (a legitimate remote administration tool) for remote control—representing a shift from prior use of **STRRAT**. Kaspersky noted the loader’s behavior includes user-deception (fake error messages) and basic execution controls (e.g., limiting repeated installation attempts), while another reported lure uses a social-engineering pretext that victims must install a **Java Runtime Environment update**, ultimately delivering a **malicious JAR**—a technique Kaspersky described as a distinctive fingerprint for this actor. Prior related reporting cited phishing activity in Kyrgyzstan distributing similar tooling, indicating a broader regional focus beyond the current Uzbekistan/Russia emphasis.
Jun 29, 2026
Researchers reported multiple phishing campaigns delivering the **DarkWatchman** remote access trojan through Russian-themed lures, including a fake **CryptoPro CSP** site and messages imitating military conscription summons. Victims were directed to download password-protected or self-extracting archives that launched a downloader, dropped an obfuscated JavaScript backdoor, and decrypted a PowerShell-based keylogger. The malware collected keystrokes, clipboard contents, smart card data, and host information, then exfiltrated the data to command-and-control infrastructure. DarkWatchman stood out for storing configuration data, payload components, and stolen information in the **Windows Registry** rather than on disk, complicating detection and forensic recovery. The malware executed via `wscript.exe`, added Windows Defender exclusions, established persistence with **Task Scheduler** using generated task names, deleted installation artifacts, and in some cases removed volume shadow copies when running with elevated privileges. Reporting also linked the malware’s delivery and operation to heavy use of obfuscation and decryption techniques, including encrypted blobs and Base64-encoded PowerShell, consistent with **MITRE ATT&CK `T1140`** behavior.
Aug 15, 2026