Core Werewolf
Also known asAwaken Likho · PseudoGamaredon · GamaCopy
Summary
Espionage cluster that targets Russia's defence industry, public sector and critical information infrastructure; BI.ZONE traces its first attempts to 2021. It is known for 7-Zip SFX droppers with military- and government-themed decoy PDFs and for abusing UltraVNC for remote access — tradecraft close enough to Gamaredon that Knownsec 404 named it GamaCopy (also Awaken Likho, PseudoGamaredon). In Jun–Jul 2026 BI.ZONE saw it phishing over Telegram and replacing UltraVNC with a custom C++ remote-access trojan, CoreRAT (in use since at least Mar 2026), dropped by 7zSFX and Rust droppers. One of its decoys matches a Vortex Werewolf lure; BI.ZONE says the data is insufficient to call them one actor. No state attribution.
Attribution
No state attribution
Tracked by researchers; no state or organisation has been publicly attributed.
- The Record, reporting Knownsec 404 (Research, 2025-01-23)
GamaCopy mimics Gamaredon; most likely linked to Core Werewolf, not tied to a country
Campaigns 2
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| CoreRAT via Telegram phishing — Russian public sector and defence industry | 2026-03 – 2026-07 | Russia | Government, Defense | BI.ZONE Threat Intelligence (2026-08-18) |
| 7z SFX + UltraVNC against Russian defence industry and CII | 2021 – 2023-05 | Russia | Defense, Critical Infrastructure | BI.ZONE (2023-06-13) — first attacks "traced back to 2021"; latest attack May 2023 (attacks dated by sample upload) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 5
| Initial Access1 | T1566.003Spearphishing via Service |
|---|---|
| Execution2 | T1204.002Malicious FileT1053.005Scheduled Task |
| Stealth1 | T1036.007Double File Extension |
| Command and Control1 | T1219Remote Access Tools |
Malware and tools 2
| Name | Description | Platform |
|---|---|---|
| CoreRAT | Remote access trojan (C++) | Windows |
| UltraVNC (abused) | Legitimate remote access tool | Windows |
Infrastructure patterns
- Domains spread across many registrars — Regtime, REG.RU, GoDaddy, OnlineNIC and others (BI.ZONE, 2023)
- Servers rented in Russia to avoid early blocklisting (BI.ZONE, 2023)
- C2 on port 443 — UltraVNC to infovesty[.]ru, later CoreRAT to dezinsekciya-top[.]ru (BI.ZONE, 2023; BI.ZONE, 2026)