CampaignPublished 29 Jan 2026Updated 28 Feb 2026

Approaching Cyclone: Vortex Werewolf Attacks Russia

Source AlienVault OTX General

Description

A new cluster is spreading malware through phishing attacks targeting Russia. The attack methodology involves fake pages that imitate file downloads from Telegram. The article likely details the structure of these attacks, providing insights into how the malicious actors are exploiting user trust in the popular messaging platform to deliver their payload. This emerging threat, dubbed Vortex Werewolf, appears to be a sophisticated campaign specifically targeting Russian users or entities.

Impact

For European organizations, the primary impact of the Vortex Werewolf campaign lies in potential compromise through social engineering targeting employees or partners with Russian connections or those who use Telegram extensively. Successful infections could lead to malware execution, potentially resulting in data theft, espionage, or lateral movement within networks. Organizations with Russian-speaking staff or business operations involving Russia are at higher risk. The campaign could disrupt operations, compromise sensitive information, and damage trust in communication channels. Additionally, if the campaign expands beyond Russia, European entities using Telegram for file sharing could become direct targets. The reliance on phishing and user execution means that the threat could bypass traditional perimeter defenses if users are not adequately trained or if email/web filtering is insufficient. Given the geopolitical tensions involving Russia, this campaign may also be part of broader cyber espionage or influence operations, increasing its strategic impact on European critical infrastructure and governmental organizations.

Defensive guidance

To mitigate the Vortex Werewolf threat, European organizations should implement targeted user awareness training focusing on the risks of phishing and the specific threat of fake Telegram download pages. Email and web filtering solutions should be configured to detect and block phishing URLs and malicious attachments, especially those mimicking Telegram or related services. Network monitoring should include detection of unusual Telegram-related traffic or file downloads. Organizations should enforce strict policies on downloading and executing files from untrusted sources, including messaging platforms. Multi-factor authentication (MFA) should be enabled on all user accounts to reduce the impact of credential compromise. Incident response teams should be prepared to analyze suspicious Telegram-related activity and respond quickly to potential infections. Collaboration with threat intelligence providers to monitor updates on Vortex Werewolf indicators and tactics is recommended. Finally, organizations should consider restricting or monitoring the use of Telegram for file sharing in sensitive environments until the threat subsides.

Summary

The Vortex Werewolf campaign is a newly identified malware distribution operation primarily targeting Russian users through phishing attacks. The attackers create fake web pages that impersonate legitimate Telegram file download pages, exploiting the widespread trust and usage of Telegram in Russia. Victims are lured into downloading malicious files under the guise of legitimate content, which then execute malware on their systems. The campaign employs several MITRE ATT&CK techniques: T1566 (Phishing), specifically T1566.002 (Spearphishing Link), T1059 (Command and Scripting Interpreter), and T1204.001 (User Execution: Malicious File). These techniques indicate a multi-stage attack involving social engineering to deliver and execute malicious payloads. While the campaign currently focuses on Russian targets, the use of Telegram as a delivery vector means that any user or organization relying on Telegram for file sharing could be at risk if the campaign expands. No known exploits are reported in the wild, and no specific software vulnerabilities are exploited, indicating the attack relies heavily on user deception and social engineering rather than technical exploits. The campaign's medium severity rating reflects its targeted nature, the need for user interaction, and the absence of automated exploitation mechanisms. The sophistication of the fake pages and the use of a trusted platform like Telegram increase the likelihood of successful compromise among targeted users.

Indicators of compromise

Domains 18

2zrek3mkl72d5b6evpkx2rz2glzrltiorgblpfb2ttg6lacwlsdk4iqd.onion
3lfdhuojbznd4fmunkkzr2m5zbnaibwuyvenclsoxvapylqv4pdldqad.onion
amvlfdftchgyoie7femnnivsfnqzizrljm5rbixgsxpzgdavdtkhtlad.onion
biavid.info
clgkhqmtssx4dgvhq5r4kb4anid4n375d2z5mqspuob3iyqvzyrxhoqd.onion
documshare.org
documtransfer.net
guardedcloud.net
safedatabox.net
trustedfiles.org

URLs 6

https://telegram-files.trustedfiles.org/?cuid=vG7LLN&cloud_access=E20340B73A&tuid=2bWqrF&hash=d3BdF6F9Bd&folder=520e66fe3F
https://telegram-files.trustedfiles.org/?folder=009c027D11&tuid=1MM5Jx&cloud_access=f8CfeE6518&hash=a9D53e2Cd9&cuid=vG7LLN
https://telegram-files.trustedfiles.org/?nash=2BC8BD579d&cloud_access=06c434ED64&tuid=efGVBj&folder=8057d1704f&cuid=3e12KE
https://telegram-files.trustedfiles.org/telegram/api/v1/file/111ea773e331412d06b1e8725df275f8/3e12KE/efGVBj/
https://telegram-share.documtransfer.net/?folder=5f6a307A22&hash=4C90FCcEB9&cuid=VxBY1g&cloud_access=BEeB5A09Ad&tuid=2CbRT0
https://tg-media.guardedcloud.net/?access_hash=ceFFc8F817&cuid=nghdRm&code=A824c7d9D3&tuid=SuCmHG

IP addresses 13

103.17.154.137
158.174.146.87
176.169.236.210
188.116.26.254
190.62.5.156
193.138.81.106
24.134.5.121
73.94.43.159
77.128.112.133
78.63.213.108

Hashes 40

111ea773e331412d06b1e8725df275f8
2fd70886f3d8712818cc74a4bd941133
3e3c5471c69e933fcffa4f497ca936b8
41155d85dbaa61801f95aa183facf4e3
4300b13d2ff5faa4fc5fc022ba29e280
44652be9dc36c33ef0a35d4422523f7c
8dbeb747aab3d3814bcee52c3b0f6ee5
cf92899f2cd2db8069d97feba7d754c6
032b8bdd1de028d36f7c785622d5ea6a17e02f90
2282e2158b7fb714f77d8b0974d980b87884933f

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 29 Jan 2026, 07:57 UTC

MITRE ATT&CK techniques5 from threat tags

Technical details