Paper Werewolf
Also known asGOFFEE
Summary
No vendor or government has linked the group to a nation-state; media describe it as widely thought to be pro-Ukrainian, while Intezer calls any state tie 'an open question' (Dec 2025). Active since 2022, targeting Russian organisations exclusively. Conducted at least 7 major campaigns per BI.ZONE. Operations go beyond espionage — intrusions include destructive components such as changing employee account passwords mid-attack. December 2025 campaign used AI-generated decoy documents targeting Russian air defense and sensitive electronics firms, delivering the EchoGather backdoor via malicious XLL files. Kaspersky tracked deployment of PowerModul (PowerShell backdoor), PowerTaskel (non-public Mythic modification), and patched explorer.exe implants. Uses Russian IP addresses/hosting (MivoCloud, Aeza, XHost) to mimic internal traffic and bypass geo-filtering.
Attribution
Pro-Ukrainian alignment inferred from targeting only
Tracked by researchers; no state or organisation has been publicly attributed.
- Reuters (via SRN News) (Press, 2025-12-19)
Widely thought pro-Ukrainian; targets almost only Russia - Intezer (Research, 2025-12-19)
Tracks a campaign against Russian defence-industry firms
Campaigns 4
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 8
| Initial Access1 | T1566.001Spearphishing Attachment |
|---|---|
| Execution3 | T1059.001PowerShellT1059.005Visual BasicT1203Exploitation for Client Execution |
| Persistence2 | T1098Account ManipulationT1547.001Registry Run Keys / Startup Folder |
| Stealth1 | T1027Obfuscated Files or Information |
| Command and Control1 | T1071.001Web Protocols |
Malware and tools 10
| Name | Description | Platform |
|---|---|---|
| PowerModul | PowerShell Backdoor | Windows |
| PowerTaskel | Mythic Agent (non-public) | Windows |
| PowerRAT | PowerShell RAT | Windows |
| EchoGather | Backdoor | Windows |
| Owowa | Malicious IIS Module | Windows |
| FlashFileGrabber | USB Exfiltration Tool | Windows |
| USB Worm | Propagation Module | Windows |
| Patched explorer.exe | Trojan | Windows |
| PaperGrabber | Stealer | Windows |
| Mythic (custom shellcode implant) | Post-exploitation Agent | Windows |
Exploited vulnerabilities 2
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2025-8088 | 8.4 | RARLAB WinRAR — path traversal via alternate data streams (KEV 2025-08-12) |
| CVE-2025-6218 | 7.8 | RARLAB WinRAR — directory traversal (KEV 2025-12-09) |
Highest CVSS first.
Infrastructure patterns
- Reused domains such as ruzede[.]com and fast-eda.my, later resolving to Russian IPs (Intezer, 2025)