A threat group tracked as Core Werewolf has added a custom remote access trojan to campaigns focused on Russia’s public sector and defense industry. The malware, named CoreRAT by BI.ZONE researchers, gives operators broad control of compromised Windows computers and marks a shift away from the group’s earlier reliance on the legitimate UltraVNC remote-access utility.

Campaign activity was observed during June and July 2026, while available evidence suggests the tool may have been in use since at least March. The delivery method combines social engineering over Telegram with files made to resemble military or government correspondence. Opening the package displays a decoy PDF while the actual payload is installed out of sight.

A purpose-built replacement for legitimate tooling

CoreRAT is written in C++ and protects its internal strings and command-and-control configuration with encryption. Developing a dedicated implant gives the operators more control over features, behavior and future changes than an off-the-shelf remote administration product. It may also reduce detections built specifically around previously observed UltraVNC misuse.

Before fully activating, the malware searches for indications that it is running in a virtual analysis environment. It examines system information, recent shortcut activity and network-adapter identifiers. If those checks suggest a laboratory or sandbox, CoreRAT exits rather than exposing more of its capabilities to researchers.

On a likely victim system, the implant builds a detailed host profile. Collected information includes the computer name, BIOS data, active processes, files on the desktop and network-adapter details. It encodes the results and sends them to its command infrastructure over HTTPS, giving operators enough context to assess the value of the machine and plan their next move.

From reconnaissance to interactive control

The remote-access feature set supports more than passive inventory. CoreRAT can enumerate directories and processes, collect network configuration and ARP information, and inspect current TCP connections. Operators can instruct it to launch a command or process, download another file, decrypt it and execute it.

Those functions make an infected endpoint a foothold for several possible objectives, including surveillance, document theft, credential access or lateral movement. The exact impact depends on the compromised user’s privileges and the follow-on tools delivered, but the ability to execute additional payloads means defenders should not limit their hunt to the original CoreRAT binary.

The malware also includes a self-removal procedure. It renames its executable, creates a temporary batch file and deletes both components after the cleanup runs. That capability can reduce the artifacts left on disk, making centralized telemetry, retained network logs and prompt evidence collection especially important.

Telegram messages hide a two-part delivery chain

Researchers observed two types of loader. One used a self-extracting 7z archive, while another used a Rust-based dropper. Both separated the visible document from the malicious program so the victim saw an apparently legitimate PDF as the infection continued. The Rust variant unpacked an archive into a temporary directory and delayed execution, helping the decoy appear first.

Several lure documents contained forged signatures, signs of editing and language that would be unusual in authentic official communication. Nevertheless, a targeted recipient may find a document convincing when it arrives through a familiar messaging channel and refers to relevant administrative or military subjects.

Defensive priorities for targeted organizations

• Block the published file, domain and IP indicators in endpoint, email and network controls.
• Investigate unexpected executable archives and documents delivered through Telegram or other chat platforms.
• Hunt for unexplained outbound HTTPS sessions from user devices and unfamiliar processes in temporary or profile directories.
• Isolate suspected hosts quickly, preserve volatile evidence and search neighboring systems for matching activity.
• Reset credentials used on affected machines if collection or lateral movement cannot be ruled out.

User awareness remains relevant, but it should reinforce rather than replace technical controls. Staff handling sensitive government or defense material need a trusted method to verify unexpected documents independently of the account that delivered them. Endpoint policies should also prevent untrusted archives and user-writable directories from becoming easy execution paths.

CoreRAT shows a maturing operation: tailored lures get the initial click, environmental checks frustrate analysis, and a custom implant provides durable remote control. Organizations within the campaign’s target profile should combine the released indicators with behavior-based hunting, because infrastructure and file hashes can change faster than the attacker’s underlying methods.