Sticky Werewolf Phishing Campaign Delivers Ozone RAT to Russian and Belarusian Targets

The Sticky Werewolf cyber-espionage group has been linked to phishing attacks against Russian scientific, industrial, and government organizations, with later reporting also identifying targets in Belarus. In one campaign, attackers impersonated Russia’s Ministry of Industry and Trade in emails carrying decoy documents and a password-protected archive; another wave used phishing links generated through IP Logger to disguise delivery URLs while collecting victim profiling data such as IP address, location, browser version, and operating system. Researchers also tied the activity to earlier spoofed-email operations themed around Russian state bodies including EMERCOM, the Ministry of Construction, and the FSB.

The intrusions ultimately deployed Ozone RAT, and in some cases Darktrack RAT, while showing victims decoy files to mask the infection. Analysts said the Ozone RAT loader was copied into %TEMP% under names such as utorrent.exe, established persistence through a shortcut in the Windows Startup folder, and used a modular chain in which it downloaded an encrypted DLL from a command-and-control server, saved it as data.dbf, decrypted it, and loaded it reflectively into memory via the Delphi API function BTMemoryModule. The malware was reported to support remote command execution, file and process management, registry changes, keylogging, screen, webcam, and microphone capture, password theft from browsers and mail clients, hidden virtual network computing (HVNC) control, reverse proxying, payload delivery, and self-deletion.