Paper Werewolf Unleashes Advanced PowerModul Implant on Russian Cyber Front

Paper Werewolf Unleashes Advanced PowerModul Implant on Russian Cyber Front

At a glance

• Paper Werewolf, a threat group that targets Russia, has deployed PowerModul, a PowerShell implant.
• The group goes after Russian organizations, and PowerModul pulls down tools that steal files and spread to USB drives.
• Its tactics are careful and persistent, which worries researchers.
• Security professionals stress the need for stronger defenses.

Who is Paper Werewolf?

Paper Werewolf, also tracked as GOFFEE, has added a new tool to its campaigns against Russian targets. The implant, PowerModul, gives the group a foothold for loading more malware. Its attacks hit sectors including media, telecommunications, construction, government and energy.

The Emergence of Paper Werewolf

Kaspersky detailed the group’s latest campaign in April 2025. The group has been active since at least 2022, and it attacks only organizations in Russia. Between July and December 2024 it used PowerModul, reaching victims through phishing emails carrying archives and macro-laced Office documents. Kaspersky’s write-up shows a well-organized operation.

PowerModul: How the implant works

PowerModul is a PowerShell script that receives further PowerShell scripts from its command server and runs them. Through it, the attackers delivered PowerTaskel, FlashFileGrabber, which steals files from removable media, and a USB worm that copies PowerModul onto flash drives. That gives the group broad control over infected systems.

It is modular. The attackers can pick tools to suit each target.

Implications and Concerns

Paper Werewolf shows how exposed infrastructure remains. Its tools work. Its intent to exploit geopolitical tensions is clear.

The skill behind PowerModul raises questions about the support and intelligence these attackers have. It also casts doubt on whether today’s defenses are good enough, and researchers recommend reviewing protections now.

Global Call for Enhanced Cybersecurity Measures

Security practitioners want stronger defenses across the board. They are calling for tougher network protection and more investment in new security technology.

Take campaigns like this seriously. A skilled group working its way through a country’s institutions, one phishing email and one infected flash drive at a time, is exactly the kind of slow, patient operation that ordinary security monitoring tends to miss for months.

What defenders should watch

Paper Werewolf’s use of PowerModul shows how far targeted campaigns have come. Defenses have to be reinforced and keep adapting. The fight against attackers is far from won, and vigilance, new ideas and cooperation are still the best tools defenders have.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.