<h1>Paper Werewolf’s Recent Cyberattacks on Russian Sectors Using PowerModul Implant</h1>
<h2>Introduction</h2>
<p>The threat actor Paper Werewolf, also known as GOFFEE, has been actively targeting various Russian sectors with sophisticated cyberattacks between July and December 2024. These sectors include mass media, telecommunications, construction, government, and energy. Paper Werewolf has leveraged an arsenal of new tools and techniques to penetrate and exploit these targets.</p>
<h2>Methods of Attack</h2>
<h3>Phishing Campaigns</h3>
<p>The typical attack vector begins with spear phishing emails containing malicious Microsoft Office documents with macros. Upon opening, the documents deploy a PowerShell script downloader known as PowerModul. This script is responsible for downloading and executing further components necessary for the attack.</p>
<h3>Infection Schemes</h3>
<p>Infection schemes used by Paper Werewolf are notably complex and involve RAR archives with executable files or macro-laced Microsoft Office documents. The initial infection phase sets the stage for additional malware placement within the network.</p>
<h2>Key Tools Used</h2>
<h3>PowerModul Implant</h3>
<p>PowerModul, the primary implant, is crucial in establishing a foothold in the targeted systems. It downloads and executes various components required for the attack.</p>
<h3>Remote Access Trojans (RATs)</h3>
<p>Following initial infection, remote access trojans are deployed to maintain control and facilitate further exploitation of the network.</p>
<h3>Data Theft and Propagation Tools</h3>
<ul>
<li><strong>FlashFileGrabber</strong>: Utilized for stealing media files from flash drives.</li>
<li><strong>USB Worm</strong>: Employed to propagate infections through USB flash drives, furthering the reach of malware within the targeted environment.</li>
</ul>
<h2>Evolution of Techniques</h2>
<p>Recent trends indicate a shift in Paper Werewolf’s strategy. There has been a move from using PowerTaskel to deploying binary Mythic agents for lateral movement across compromised networks. These agents, which were initially non-public and executed in PowerShell, have become more refined and binary-focused, posing increased challenges for detection and mitigation.</p>
<h2>Conclusion</h2>
<p>Paper Werewolf, leveraging the GOFFEE toolkit, has demonstrated significant capability in conducting targeted cyberattacks against Russian sectors. The sophistication of their tools, such as PowerModul, FlashFileGrabber, and USB Worm, combined with their evolving tactics, underscores the need for enhanced cybersecurity measures among potential targets. Continuous monitoring, employee training on phishing tactics, and prompt update of security systems are critical in defending against such advanced persistent threats.</p>


Collections

Paper Werewolf, also known as GOFFEE, has targeted various Russian sectors, including media, telecommunications, construction, government, and energy, with sophisticated cyberattacks between July and December 2024. The primary attack techniques involve phishing campaigns and the deployment of the PowerModul implant, remote access trojans, and tools like FlashFileGrabber and USB Worm. The group's strategies have evolved, making detection and mitigation increasingly challenging.

GOFFEE's Deployment of PowerModul in Targeted Cyberattacks on Russian Sectors