A newly identified remote access trojan, dubbed CoreRAT, has emerged in mid-2026 attacks linked to the Core Werewolf group, enabling full control of infected Windows computers. First spotted in campaigns from June through July—but with signs it’s been active since at least March—CoreRAT adds a bespoke tool to the group’s hacking arsenal. The campaign has targeted entities in Russia’s public sector and defense industry.
Infection via Phishing, Military/Official Decoys
The malware spreads through phishing campaigns delivered via Telegram, using attachments masquerading as official government or military documents. When victims open the attachment, they’re shown a legitimate-looking PDF decoy, while hidden programs install the core malware. Two distinct delivery methods were used: a self-extracting 7z archive and a dropper built with Rust. Both deliver a decoy alongside the malicious payload to keep the infection hidden during early execution.
Features & Capabilities
CoreRAT is written in C++ and includes encrypted internal text and command-and-control (C2) addresses. It performs anti-analysis checks—looking for indicators of virtual machines, recent shortcut usage, and network adapter IDs—and kills itself if it detects a suspicious environment. On real machines, it harvests system details such as computer name, BIOS info, running processes, desktop files, and network adapter data, then transmits these over HTTPS to its operators.
The malware also supports a range of post-infection actions. It can list folders, inspect active processes, retrieve network configuration and ARP tables, enumerate active TCP connections, execute arbitrary commands, deploy and decrypt further payloads, and launch them. After finishing its mission, CoreRAT may self-destruct: it can rename its executable, spawn a temporary batch file, and erase both the dropper and its own files.
Indicators of Compromise & Defenses
Security researchers provided a list of SHA-256 hashes of several payloads (for the 7z and Rust-dropper versions), decoy PDFs, and CoreRAT payloads. Dozens of malicious executable file names observed include fake names implying official documents or generic tools like Firepoin.exe and LiteEdit.exe. Decoy PDFs with authentic-looking titles and forged signatures amplify the threat of mistaking them for legitimate files.
C2 infrastructure is spread across domains and IPs ending in .ru and other top-level domains, all using HTTPS on port 443. Observed domains and IP addresses are already captured in IoC listings. Organizations should block these network indicators, watch endpoints for matching file names and hashes, and raise alerts on unexpected HTTPS traffic from endpoints.
When a compromise is detected, fast containment is vital: isolate the host(s), reset credentials where exposure is likely, search for similar breaches in nearby devices, and preserve forensic evidence aggressively. Treat any document-bearing archive, particularly those claiming to be official, as suspicious until confirmed safe.
CoreRAT replaces the group’s previous reliance on legitimate remote-access tools like UltraVNC. The shift towards proprietary malware gives attackers more flexibility to adapt while also complicating detection. The use of forged documents, delayed execution, and decoys reflects evolving sophistication in social engineering and malware delivery.
Analytically, the advent of CoreRAT signals a turning point in Core Werewolf’s operational maturity. By building and deploying custom remote access trojans instead of repurposing off-the-shelf tools, the group is positioning itself for more flexible and stealthy attacks. Defense teams must adjust: endpoints, staff training, IoC sharing, and threat intelligence will need rapid updating. What to watch now are any signs CoreRAT being ported to other platforms or seen in regions beyond its current targeting—and whether its operators improve evasion further, such as using zero-day vulnerabilities or in-memory execution.
