This campaign involves sophisticated spear-phishing targeting Russian aerospace and aviation sectors, likely conducted by the Rare Werewolf threat group. Initial infection vectors are fraudulent emails impersonating a legitimate aerospace research institute, containing password-protected archives with malicious installers. The attackers leverage living-off-the-land techniques by abusing legitimate software tools including AnyDesk (configured for unattended remote access), Blat (SMTP client), WinRAR, and Tray Minimizer to establish and maintain persistence. Data exfiltration is performed via SMTP to attacker-controlled infrastructure. Persistence mechanisms include scheduled tasks. The threat actors minimize the AnyDesk interface and remove forensic artifacts to evade detection. The campaign methodology is consistent with previously documented Rare Werewolf operations against strategically important sectors in Russia and neighboring countries.

Successful compromise enables attackers to gain persistent remote access to targeted aerospace organizations, potentially allowing unauthorized data exfiltration and covert monitoring. The use of legitimate tools and living-off-the-land techniques complicates detection and forensic analysis. The campaign specifically targets sensitive aerospace and aviation sectors, which may have national security implications for Russia and related regions.

No official patch or fix is applicable as this is a threat campaign rather than a software vulnerability. Organizations should implement targeted defenses against spear-phishing, including user awareness training to recognize fraudulent emails and password-protected attachments. Monitoring for unauthorized use of remote access tools like AnyDesk and suspicious scheduled tasks is recommended. Incident response should focus on identifying and removing malicious persistence mechanisms and blocking exfiltration channels such as unauthorized SMTP traffic. Since the campaign uses living-off-the-land techniques, endpoint detection and response solutions tuned to detect anomalous legitimate tool usage can help mitigate impact.