Seqrite Details Phishing Campaign Using AnyDesk for Persistent Access to Russian Aerospace Targets

Jul 7, 2026 · Original article ↗

Summary

Seqrite traced a phishing campaign targeting Russian aerospace organizations from a password-protected archive to unattended AnyDesk access, scheduled-task persistence, and SMTP exfiltration of configuration data. Rare Werewolf links are suspected, not confirmed.

Key points

A spear-phishing email impersonated Russian institute VNIIR and delivered a password-protected invoice-themed RAR archive.
The dropper opened a decoy PDF, staged files, and used command scripts to retrieve and extract additional payloads.
The payload deployed portable AnyDesk, Blat, and Tray Minimizer; a script configured unattended access with a preset password.
A scheduled task launched Tray Minimizer at user logon, while the script deleted temporary files to reduce forensic artifacts.
The campaign archived AnyDesk configuration data and sent it over SMTP using Blat through mail[.]versio[.]nl.
Seqrite says the tradecraft aligns with Rare Werewolf, also known as Librarian Ghouls, but notes attribution is not definitive; its sample showed no cryptojacking.

Article Details

Attack Vectors: Spear-phishing email impersonating the Russian research institute Federal Budgetary Institution “VNIIR” and carrying a password-protected RAR archive.
The extracted dropper opens a decoy PDF, writes temporary files, and uses command scripts to retrieve and extract additional payloads.
A batch script configures unattended AnyDesk access, creates a scheduled task to launch Tray Minimizer at user logon, and deletes temporary artifacts.
AnyDesk configuration data is archived and exfiltrated over SMTP using Blat.
Defensive Notes: The article lists Seqrite XDR coverage for multi-stage payload download and execution via Curl and Command Shell.
The article lists Seqrite XDR coverage for remote access tool staging and SMTP data exfiltration.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`aviatronika[.]online`	Domain listed as campaign spoofing, staging, or exfiltration infrastructure.
DOMAIN	`fgub-vniir[.]space`	Domain listed as campaign spoofing, staging, or exfiltration infrastructure.
DOMAIN	`nova-stream[.]site`	Related campaign infrastructure domain listed in the indicators.
DOMAIN	`vniir-avia[.]space`	Lookalike domain used to send the phishing email impersonating VNIIR.
DOMAIN	`vniir-info[.]space`	Related campaign infrastructure domain listed in the indicators.
EMAIL	`in@okbm-bus[.]nl`	Recipient account used in the campaign's SMTP exfiltration of the AnyDesk archive.
EMAIL	`out@okbm-bus[.]nl`	Sender account used in the campaign's SMTP exfiltration of the AnyDesk archive.
EMAIL	`sales@vniir-avia[.]space`	Phishing sender address used with the lookalike domain to impersonate VNIIR.
IPV4	`109[.]106[.]178[.]14`	Campaign infrastructure IP listed among the indicators.
IPV4	`194[.]87[.]57[.]81`	Campaign infrastructure IP listed among the indicators.
IPV4	`198[.]54[.]120[.]13`	Campaign infrastructure IP listed among the indicators.
IPV4	`2[.]23[.]88[.]201`	Campaign infrastructure IP listed among the indicators.
SHA256	`0dc0fa727f900ed5033f46f8ba6cf2d97d20ab95fd334cabc0f216da6e0622b0`	SHA-256 of a malicious or related campaign file, listed in the article's indicators.
SHA256	`12648cd9d425f78db2dbc6e03c14f11e6ac6aadf8b3975c23cce9519e2b58d33`	SHA-256 of a malicious or related campaign file, listed in the article's indicators.
SHA256	`47854deb456cb08c651b7f9ae2f9d87c72d0719de6af233340632efb3c1980f4`	SHA-256 of a malicious or related campaign file, listed in the article's indicators.
SHA256	`f57e010541fb4ccbf23aefc4a827f753a6ff3f8792d9c04c3eea83f6963c6bae`	SHA-256 of a malicious or related campaign file, listed in the article's indicators.