Spear-Phishing Campaign Targets Russian Aerospace Organizations Using AnyDesk and Data Exfiltration Tools
By
Seqrite
Summary
Seqrite reports a spear-phishing campaign targeting Russian aerospace organizations. The attackers impersonate the Russian research institute ФБУ "ВНИИР" and deliver a password-protected archive containing AnyDesk (remote access), Blat (email/SMTP tool), and Tray Minimizer (persistence tool) to establish persistent remote access and exfiltrate data. The tradecraft closely matches the threat actor known as Rare Werewolf (Librarian Ghouls), with related infrastructure including vniir-avia.space and mail.versio.nl.
Source
bskySpear-Phishing Campaign Targets Russian Aerospace Organizations Using AnyDesk and Data Exfiltration Toolshendryadrian.comKey quotes
· 2 pulledSeqrite reports a spear-phishing campaign impersonating the Russian research institute ФБУ "ВНИИР" to deliver a password-protected archive that stages AnyDesk, Blat, and Tray Minimizer for persistent remote access and data exfiltration.
The tradecraft closely matches Rare Werewolf (Librarian Ghouls), with related infrastructure such as vniir-avia.space, mail.versio.nl, and attacker use of AnyDesk.
You might also wanna read
Sophisticated Phishing Campaign Targets SendGrid Users with Political-Themed Emails
The article describes a sophisticated phishing campaign targeting SendGrid users that exploits American political tensions. Hackers send ema
fredbenenson.com·5mo ago
Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT
Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities
Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT
Russian Cybercrime Groups Exploit WinRAR Zero-Day Vulnerability
A high-severity zero-day vulnerability in WinRAR is being actively exploited by two Russian cybercrime groups, allowing them to backdoor com
arstechnica.com·10mo ago
Roundcube Webmail Vulnerability Allows Email Tracking Despite Image Blocking
Roundcube Webmail versions before 1.5.13 and 1.6.13 contain a security vulnerability (CVE-2026-25916) that allows attackers to bypass remote
nullcathedral.com·4mo ago
Comments
Sign in to join the conversation.
No comments yet. Be the first.