Paper Werewolf targets Russia with WinRAR zero-day vulnerability

Description

A series of attacks by the Paper Werewolf (GOFFEE) cluster exploited vulnerabilities in WinRAR, including CVE-2025-6218 and a zero-day flaw. The threat actor used phishing emails impersonating Russian organizations, delivering malware through archive files. The attacks targeted Russian entities, utilizing advanced techniques to bypass defenses and enhance toolkits. The malware, delivered via compromised RAR files, created malicious executables in startup folders and connected to C2 servers. The threat actor demonstrated strong capabilities in exploiting zero-day vulnerabilities and modifying existing tools for their purposes. Multiple attack iterations were observed, with slight variations in payload delivery and execution methods.