Sticky Werewolf is targeting the Russian and Belarusian aviation industries

Recently, a threat group named Sticky Werewolf has been targeting entities in Russia and Belarus. Sticky Werewolf first emerged in April 2023, initially targeting public organisations in Russia and Belarus, and has now expanded to several other types of organisations, including pharmaceutical companies and Russian research institutes working on microbiology and vaccine development. In a recent campaign, Sticky Werewolf sent emails to the aviation industry, purportedly from the First Deputy General Director of AO OKB Kristall. AO OKB Kristall, headquartered in Moscow, operates in the production and maintenance of aircraft and spacecraft. Previously, AO OKB Kristall was sent phishing emails with links to malicious files; Sticky Werewolf used Archive files containing LNK files that pointed to payloads stored on WebDAV servers. After executing the binary hosted on the WebDAV server, an obfuscated Windows batch script is launched, which starts an AutoIT script, eventually injecting the payload into the endpoint. Past infections began with downloading phishing emails containing links to malicious files from platforms like gofile.io, but now, the infection method has changed. The email contains an Archive document attachment. The recipient downloads the attachment, opens the LNK file and the decoy file, and the LNK file connects to an executable hosted on a WebDAV server. Once executed, a batch script is launched, which in turn starts an AutoIT script, ultimately injecting the payload into the endpoint. This Archive document attachment includes a decoy PDF file and two LNK files disguised as DOCX files, named Повестка совещания.docx.lnk (Meeting Agenda) and Список рассылки.docx.lnk (Mailing List) respectively.

Sticky Werewolf impersonated the First Deputy General Director and Executive Director of AO OKB Kristall to send phishing emails, with recipients in the aerospace and defence sectors. The emails ostensibly invited them to attend a video conference to discuss future cooperation, but actually contained password-protected attachments containing malicious payloads. The payloads used by Sticky Werewolf include not only purchased commercialized RATs and stealers, but Sticky Werewolf has also used the Rhadamanthys stealer and Ozone RAT in its campaigns. In previous attacks, the group has also deployed MetaStealer, DarkTrack, and NetWire. This malware can perform extensive espionage and data exfiltration. Although there is no definitive evidence indicating the attribution of Sticky Werewolf, judging from the geopolitical context, it may be associated with pro-Ukrainian cyber espionage groups or hacktivists. Currently, attack simulation rules targeting this threat group have been integrated into the SecurityGauge platform. You can search for the keywords "AutoIt", "MetaStealer", "NetWire", "Strealer", "LNK" in the SecurityGauge platform to obtain relevant attack simulation verification actions, thereby verifying whether your security defence system can effectively counter attacks from this threat group. The platform ensures that your verification process is safe and harmless in an industry-unique manner.