UnattributedUnattributedEspionageActive 2024 – 2025
Sapphire Werewolf
Summary
Active since March 2024, conducted 300+ attacks against Russian organisations. Deploys Amethyst stealer, a modified version of the open-source SapphireStealer. Distribution via phishing emails disguised as court proceedings notices, Central Election Commission bulletins, and presidential decrees — targeting Russian social engineering contexts. Harvests Telegram configs, browser credentials (Chrome, Opera, Yandex, Brave, Edge, Orbitum, Atom, Kometa), FileZilla/SSH configs, and documents from USB/removable media.
Attribution
UnattributedNo state attribution: Unattributed
No state attribution
Tracked by researchers; no state or organisation has been publicly attributed.
Sources
- BI.ZONE (Research, 2025-04-09)
Tracks it as an espionage cluster
Campaigns 2
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Energy sector HR-memo phishing — updated Amethyst stealer | 2025-02 | Russia | Energy | BI.ZONE (2025-04-09) — HR-memo lure ('Служебная записка.rar'), .NET loader, Amethyst with VM checks and Triple DES; Telegram/browser credentials, RDP configs, documents |
| 300+ Attack Russian Organisations | 2024-03 – 2024-06 | Russia | Education, Industrial, IT, MIC, Aerospace | BI.ZONE via The Record (2024-06-07) — 300+ Russian organisations in three months (education, manufacturing, IT, defence, aerospace) with Amethyst |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 4
| Initial Access1 | T1566.001Spearphishing Attachment |
|---|---|
| Credential Access2 | T1555Credentials from Password StoresT1552.001Credentials In Files |
| Collection1 | T1025Data from Removable Media |
Malware and tools 1
| Name | Description | Platform |
|---|---|---|
| Amethyst | Infostealer (SapphireStealer fork) | Windows |
Infrastructure patterns
- Telegram channel posts act as a dead drop for its C2 address (BI.ZONE, 2024)