New CoreRAT Malware Gives Core Werewolf Hackers Full Control of Compromised Systems

A new remote access trojan called CoreRAT is giving the Core Werewolf threat group a way to take over infected Windows systems.

The malware appeared in campaigns observed from June through July 2026, though evidence shows it has been active since at least March. Its arrival marks an expansion of the group’s toolkit.

The attackers used phishing messages on Telegram to reach targets, then relied on files dressed up as official military or government documents.

Victims who opened the attachments received a PDF decoy while a hidden program installed the malware. The operation is believed to have focused on Russia’s public sector and defense industry.

BI.ZONE analysts identified the previously undocumented tool and said it replaced the group’s earlier use of legitimate UltraVNC remote access software.

This change matters because custom malware can be altered quickly, made harder to spot, and adapted to the attackers’ needs.

BI.ZONE said in a report shared with Cyber Security News (CSN) that CoreRAT is the group’s first fully functional remote access trojan. The campaign shows how familiar documents can turn routine communication into a security risk.

Core Werewolf used two delivery programs, including a self-extracting 7z archive and a Rust-based dropper. Both planted a decoy alongside the payload, helping the attack look harmless when it begins.

New CoreRAT Malware

CoreRAT is written in C++ and encrypts its internal text and command-and-control addresses. Before it runs, it looks for signs that it is inside a virtual test machine, checking system details, recent shortcut activity, and network adapter identifiers.

If it suspects analysis, it shuts down instead of revealing its behavior. On a real victim machine, the malware collects the computer name, BIOS data, running processes, desktop files, and network adapter information.

It packages the results, encodes them, and sends them over HTTPS to its command server. That gives operators an early picture of the system and its likely value to the attackers. The data can help attackers decide what to steal or run next.

The tool can list folders, inspect processes, collect network configuration and ARP data, and review active TCP connections.

In addition, it can run a supplied command or process, download additional files, decrypt them, and launch them. This means a successful infection can become a starting point for theft, surveillance, or a wider intrusion.

CoreRAT can also delete itself after completing a task. Its removal routine renames the executable, creates a temporary batch file, and erases both pieces once the removal is complete.

That behavior, combined with encrypted configuration data, reinforces why teams investigating a suspected compromise should preserve logs and collect evidence quickly.

Telegram Lures Mask Delivery

The 7z-based delivery chain copied a decoy PDF and the CoreRAT executable into different user folders before opening both.

The Rust version unpacked a ZIP archive into the temporary directory, displayed a document, and delayed execution using a ping command. This approach resembles the MostereRAT Windows RAT campaign, where an apparent document conceals a remote-access infection.

Researchers found several decoys that carried wording unusual for official communications, traces of document editing, and forged signatures.

One PDF also resembled a file used by Vortex Werewolf, but the evidence was not sufficient to confirm a shared group or infrastructure. The documents were designed to lower a recipient’s suspicion.

Organizations should treat unexpected document files, especially executables made to resemble official notices, as potential threats.

Security teams should block network indicators, monitor endpoints for file names and hashes, and investigate unexplained outbound HTTPS traffic.

User awareness also remains important, as shown by the LinkedIn remote access campaign, which used trusted messaging to push weaponized archives.

Fast detection and containment are central to limiting harm. Teams should isolate affected devices, reset credentials where exposure is possible, review nearby hosts for the same indicators, and retain artifacts for analysis.

Defenders can also apply lessons from the Google Cloud Remcos campaign, while court-themed lures in the covert RAT court campaign underline why every claimed official document needs scrutiny.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post New CoreRAT Malware Gives Core Werewolf Hackers Full Control of Compromised Systems appeared first on Cyber Security News.