Full Report
The campaign has affected hundreds of Russian users, particularly targeting industrial enterprises and engineering schools, with additional victims reported in Belarus and Kazakhstan.
Analysis Summary
# Incident Report: Rare Werewolf Cryptomining and Data Theft Campaign
## Executive Summary
The threat actor group Rare Werewolf has been conducting a large-scale campaign targeting computers across Russia, Belarus, and Kazakhstan since December 2024, primarily focusing on industrial enterprises and engineering schools. Attackers initially gained access via sophisticated phishing emails leading to the deployment of the XMRig cryptominer to leverage victim computing power. The attackers also steal credentials, sensitive documents, and compromise Telegram accounts, employing a unique timed persistence mechanism involving daily computer shutdowns.
## Incident Details
- Discovery Date: Ongoing as of last month (from report date, campaign started December 2024)
- Incident Date: Began in December 2024
- Affected Organization: Hundreds of Russian users, industrial enterprises, and engineering schools. Partial victims in Belarus and Kazakhstan.
- Sector: Industrial/Enterprise, Education
- Geography: Russia, Belarus, Kazakhstan
## Timeline of Events
### Initial Access
- Date/Time: Campaign started December 2024
- Vector: Phishing emails written in Russian.
- Details: Emails contained password-protected archives with malicious executable files, disguised as official documents or payment orders from legitimate organizations.
### Lateral Movement
- Details: After gaining initial access, the hackers stole login credentials, which likely facilitated further internal reconnaissance and deployment of malware.
### Data Exfiltration/Impact
- Details: Deployment of XMRig for cryptocurrency mining using victim CPU/GPU power. Stole sensitive documents, passwords, and compromised Telegram messenger accounts (historically or in current campaign).
### Detection & Response
- Detection: Reported by Kaspersky.
- Response: Not explicitly detailed in the context, but actions would involve analysis and potentially blocking C2 infrastructure.
## Attack Methodology
- Initial Access: Phishing via password-protected archives containing malicious executables.
- Persistence: A novel method where infected devices are programmed to shut down daily at 5 a.m., launching Microsoft Edge at 1 a.m. prior to shutdown to "wake up" the computer and re-establish remote access (a four-hour operational window).
- Privilege Escalation: Implied through credential theft.
- Defense Evasion: Use of a legitimate multi-purpose tool (XMRig) and the unique timed shutdown/wake mechanism to limit visibility.
- Credential Access: Explicitly stated that login credentials were being stolen.
- Discovery: Collected information about available CPU cores and GPUs to optimize XMRig configuration.
- Lateral Movement: Likely achieved via stolen credentials.
- Collection: Sensitive documents, passwords, and Telegram account compromise.
- Exfiltration: Credentials and collected data sent to attacker servers for configuration data; data theft for documents/credentials.
- Impact: Unauthorized use of victim CPU/GPU resources; data theft/espionage.
## Impact Assessment
- Financial: Financial impact results from electricity usage and loss of computing resources on victim systems (cryptomining).
- Data Breach: Sensitive documents and user passwords were stolen; Telegram accounts were compromised.
- Operational: Potential performance degradation on targeted industrial and educational systems due to resource consumption by mining software.
- Reputational: Damage to organizations targeted by the breach, though public disclosure details are limited to research findings.
## Indicators of Compromise
- Network indicators: C2 communications related to XMRig configuration data transfer (Specific IPs/domains not provided in text).
- File indicators: Malicious executable files delivered via password-protected archives. XMRig software installer.
- Behavioral indicators: Daily device reboots/wakes initiated via scheduled Microsoft Edge launch at 1 a.m. High CPU/GPU utilization unrelated to legitimate tasks.
## Response Actions
- Containment: (Implied) Identification and removal of XMRig software and persistence scripts from affected endpoints.
- Eradication: (Implied) Revoking stolen credentials and securing Telegram accounts.
- Recovery: (Implied) Restoring system baselines and monitoring for re-infection.
## Lessons Learned
- Relying on legitimate software for malicious ends (like XMRig) complicates detection based on signatures alone, requiring behavior-focused monitoring.
- The attackers utilize highly customized persistence mechanisms (timed wake/shutdown) designed to maximize operational time while minimizing the window for security analysis.
- Phishing remains a highly effective initial access vector, especially when tailored to local language and context (Russian language emails).
## Recommendations
- Implement enhanced email security scanning and mandatory user training focusing on identifying suspicious archives attached to communications, especially those disguised as official documents.
- Implement strict controls over endpoint resource utilization, setting alerts for sustained high CPU/GPU usage indicative of cryptomining activity like XMRig.
- Review and harden persistence mechanisms, ensuring scheduled tasks or system startup routines do not allow unauthorized remote access tools or programs to execute remotely.