Malware or LLM? Silent Werewolf employs new loaders to attack Russian and Moldovan organizations
Essential information
- Published
- 27/05/2025 16:45
- Modified
- 27/05/2025 17:15
- Tags
- 2025-05-27 c# loader obfuscation phishing xdigo
- Related entities
- 28 observables, 1 intrusion sets (apt), 15 techniques (mitre), 1 malware, 5 others
Description
Silent Werewolf has launched two new campaigns targeting Russian and Moldovan organizations, utilizing sophisticated loaders to deliver malicious payloads. The attacks employ phishing emails with ZIP attachments containing obfuscated C# loaders. These loaders use legitimate tools and code obfuscation to evade detection. The first campaign exclusively targeted Russian energy, aircraft, and engineering sectors, while the second focused on both Moldovan and Russian entities. The adversaries hinder payload retrieval, making analysis challenging. They also utilize the Llama 2 large language model in some instances to bypass defenses. The campaigns demonstrate the threat actor's evolving tactics and their continued focus on espionage in the region.