Reported by 2 outlets
Core Werewolf Hackers Deploy New CoreRAT Malware Against Russian Government and Defense Organizations
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.58 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Core Werewolf Hackers Deploy New CoreRAT Malware Against Russian Government and Defense Organizations
gbhackers.com · 49d ago · August 26th, 2026
The Core Werewolf espionage cluster has introduced a previously undocumented remote access trojan dubbed CoreRAT in targeted attacks on Russian public-sector bodies and defense-industry organizations. The shift is notable because Core Werewolf, previously associated with the abuse of legitimate UltraVNC remote-access software and smaller custom backdoors, now operates a full-featured C++ RAT of its own. […] The post Core Werewolf Hackers Deploy New CoreRAT Malware Against Russian Government and Defense Organizations appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
CoreRAT Malware Lets Core Werewolf Hackers Take Full Control of Compromised Systems
cyberpress.org · 48d ago · August 26th, 2026
The malware gives operators broad control over infected Windows systems, allowing them to run commands, collect information, download payloads, and remove evidence after an operation. The campaign appears tied to ongoing geopolitical tensions. Instead of relying on legitimate UltraVNC remote-access software, the threat group deployed its own C++-based RAT. This change may help the attackers avoid security detections based on known remote-administration tools and shows an increase in their malware-development capability. Its feature set supports reconnaissance, command execution, file transfer, network discovery, and self-deletion. CoreRAT Gives Werewolf Control The attackers used phishing lures disguised as military, government, and administrative documents. Several executable filenames were written in Russian and designed to resemble official correspondence, including refresher-training notices, passport-related files, and instructions. CoreRAT Gives Werewolf Control (Source: bi.zone) Researchers identified two main delivery methods: 7z self-extracting archive (7zSFX) droppers and Rust-based droppers. Both methods contained a legitimate-looking PDF decoy alongside the CoreRAT payload. The 7zSFX droppers copied the PDF to common