GOFFEE continues to attack organizations in Russia

Researchers warn about ‘Goffee’ spilling onto Russian flash drives

A cyber-espionage campaign aimed at Russia has added malware that specifically targets flash drives, analysts at Kaspersky said.

Paper Werewolf Deploys PowerModul Implant in Targeted Cyberattacks on Russian Sectors

The threat actor known as Paper Werewolf has been observed exclusively targeting Russian entities with a new implant called PowerModul. The activity, which took place between July and December 2024, singled out organizations in the mass media, telecommunications, construction, government entities, and energy sectors, Kaspersky said in a new report published Thursday. Paper Werewolf, also known

GOFFEE continues to attack organizations in Russia

文章描述了威胁行为者GOFFEE针对俄罗斯实体的网络攻击活动，利用鱼叉式网络钓鱼邮件和恶意附件进行初始感染。攻击中使用了多种恶意软件工具，包括PowerTaskel、PowerModul和USB Worm，并通过WinRM服务进行横向移动。GOFFEE在2024年引入了新的植入工具PowerModul，并逐渐转向使用二进制Mythic代理进行内部传播。

GOFFEE’s recent attacks: new tools and techniques

Kaspersky researchers analyze GOFFEE’s campaign in H2 2024: the updated infection scheme, new PowerModul implant, switch to a binary Mythic agent.