This campaign involves spear-phishing emails impersonating a Russian aerospace research institute, delivering password-protected archives containing malicious installers. The attackers leverage living-off-the-land techniques by abusing legitimate tools including AnyDesk (configured for unattended remote access), Blat (SMTP exfiltration), WinRAR, and Tray Minimizer. Persistence is achieved through scheduled tasks, and the attackers conceal their presence by minimizing the AnyDesk interface and removing forensic artifacts. The campaign is attributed to the Rare Werewolf threat group and targets aerospace and aviation organizations primarily in Russia and neighboring countries. The attack chain facilitates persistent remote access and data exfiltration to attacker-controlled infrastructure.

The campaign enables attackers to gain persistent remote access to targeted aerospace organizations, potentially allowing unauthorized data exfiltration and long-term espionage. The use of legitimate tools complicates detection and forensic analysis. The targeting of strategic aerospace and aviation sectors in Russia and nearby countries suggests potential impact on critical infrastructure and sensitive information confidentiality.

No official patch or fix applies as this is a phishing campaign leveraging legitimate tools. Organizations should focus on user awareness training to recognize spear-phishing attempts, implement email filtering to block malicious attachments, and monitor for unusual use of AnyDesk and other legitimate tools. Restricting or monitoring the use of remote access tools like AnyDesk and enforcing strong password policies for unattended access can reduce risk. Scheduled tasks should be audited regularly to detect unauthorized persistence mechanisms. Since this campaign uses living-off-the-land techniques, endpoint detection and response (EDR) solutions tuned to detect anomalous behavior of legitimate tools are recommended.