Rare Werewolf 'Invoice to AnyDesk' Spear-Phishing Campaign: OTX Pulse Analysis — Russian Aerospace Targeting Detection Pack

---
title: AnyDesk Remote Access Tool Installation or Execution
id: 7f3a1b2e-9c4d-4e5f-8a6b-rarewerewolf001
status: experimental
description: Detects installation or execution of AnyDesk, abused by Rare Werewolf as a remote access trojan in the aerospace spear-phishing campaign. Tune against approved RMM software inventory.
author: Security Arsenal Threat Intelligence
references:
    - https://www.seqrite.com/blog/from-invoice-to-anydesk-uncovering-a-phishing-campaign-targeting-russian-aerospace-organizations/
date: 2026/08/08
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\AnyDesk.exe'
    selection_cmd:
        CommandLine|contains:
            - 'AnyDesk'
            - '--install'
            - '--silent'
    selection_path:
        Image|contains:
            - '\AppData\Roaming\AnyDesk\'
            - '\AppData\Local\Temp\'
            - '\Downloads\'
    condition: selection_img or (selection_cmd and selection_path)
falsepositives:
    - Legitimate IT department use of AnyDesk; whitelist managed deployment paths and codesigning of approved versions
level: high
tags:
    - attack.command_and_control
    - attack.t1219
---
title: Scheduled Task Persistence via Schtasks or TaskService Registration
id: 8e4b2c3f-0d5e-5f6a-9b7c-rarewerewolf002
status: experimental
description: Detects creation of scheduled tasks executing from suspicious user-writable or temp paths, matching Rare Werewolf persistence tradecraft following malicious installer execution.
author: Security Arsenal Threat Intelligence
date: 2026/08/08
logsource:
    category: process_creation
    product: windows
detection:
    selection_tool:
        Image|endswith:
            - '\schtasks.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_schtasks:
        CommandLine|contains:
            - '/create'
            - 'Register-ScheduledTask'
    selection_path:
        CommandLine|contains:
            - '\AppData\'
            - '\Temp\'
            - '\ProgramData\'
            - '\Users\Public\'
    condition: selection_tool and selection_schtasks and selection_path
falsepositives:
    - Software installers registering update tasks; filter on known publisher task names
level: high
tags:
    - attack.persistence
    - attack.t1053.005
---
title: Suspicious SMTP Exfiltration from Non-Mail Workstation Process
id: 9f5c3d4a-1e6f-6a7b-0c8d-rarewerewolf003
status: experimental
description: Detects non-standard processes initiating outbound SMTP connections, consistent with Rare Werewolf's SMTP-based data exfiltration channel.
author: Security Arsenal Threat Intelligence
date: 2026/08/08
logsource:
    category: network_connection
    product: windows
detection:
    selection_port:
        DestinationPort:
            - 25
            - 465
            - 587
    filter_legit:
        Image|endswith:
            - '\OUTLOOK.EXE'
            - '\thunderbird.exe'
            - '\MsExchange*.exe'
    condition: selection_port and not filter_legit
falsepositives:
    - Line-of-business applications with SMTP reporting; baseline per-host then alert on deviation
level: medium
tags:
    - attack.exfiltration
    - attack.t1048.003

// Rare Werewolf 'Invoice to AnyDesk' campaign hunt
// Correlates: phishing IOC domains, AnyDesk execution, scheduled task persistence, SMTP egress
let lookback = 14d;
let phishingDomains = dynamic(["vniir-info.space", "vniir-avia.space"]);
let iocHashes = dynamic([
    "0dc0fa727f900ed5033f46f8ba6cf2d97d20ab95fd334cabc0f216da6e0622b0",
    "12648cd9d425f78db2dbc6e03c14f11e6ac6aadf8b3975c23cce9519e2b58d33",
    "47854deb456cb08c651b7f9ae2f9d87c72d0719de6af233340632efb3c1980f4",
    "f57e010541fb4ccbf23aefc4a827f753a6ff3f8792d9c04c3eea83f6963c6bae"
]);
let dnsHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where RemoteUrl in~ (phishingDomains)
    | project DnsTime=TimeGenerated, DeviceName, RemoteUrl, InitiatingProcessFileName, ReportId;
let anydeskExec =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName =~ "AnyDesk.exe"
       or ProcessCommandLine has_any ("AnyDesk", "--install")
    | where not(FolderPath has_any ("C:\\Program Files\\AnyDesk")) // tune to approved deployment path
    | project AnyDeskTime=TimeGenerated, DeviceName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, AccountName, ReportId;
let persistence =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName =~ "schtasks.exe" and ProcessCommandLine has "/create"
    | where ProcessCommandLine has_any ("\\AppData\\", "\\Temp\\", "\\ProgramData\\", "\\Users\\Public\\")
    | project TaskTime=TimeGenerated, DeviceName, ProcessCommandLine, InitiatingProcessFileName, ReportId;
let hashHits =
    DeviceFileEvents
    | where TimeGenerated > ago(lookback)
    | where SHA256 in~ (iocHashes)
    | project FileTime=TimeGenerated, DeviceName, FileName, FolderPath, SHA256, ReportId;
union dnsHits, anydeskExec, persistence, hashHits
| summarize FirstSeen=min(DnsTime), Signals=count(), SignalTypes=make_set_if(ReportId, isnotnull(ReportId)) by DeviceName
| sort by Signals desc

#Requires -RunAsAdministrator
# Rare Werewolf 'Invoice to AnyDesk' campaign — host IOC hunt
# Checks: unauthorized AnyDesk installs, suspicious scheduled tasks, phishing domain DNS cache hits, malware hashes, SMTP egress

$report = @()

# 1. Phishing domain indicators (OTX pulse)
$phishDomains = @("vniir-info.space","vniir-avia.space")
Write-Host "[*] Checking DNS client cache for phishing domains..." -ForegroundColor Cyan
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
    $d = $_.Entry; $phishDomains | Where-Object { $d -like "*$_*" }
}
if ($dns) { $report += [pscustomobject]@{Check="DNS_PhishDomain"; Result=($dns | Out-String); Severity="CRITICAL"} }

# 2. Unauthorized AnyDesk presence
Write-Host "[*] Checking for AnyDesk installation and processes..." -ForegroundColor Cyan
$anydeskProc = Get-Process -Name "AnyDesk" -ErrorAction SilentlyContinue
$anydeskPaths = @(
    "$env:APPDATA\AnyDesk",
    "$env:LOCALAPPDATA\AnyDesk",
    "$env:ProgramFiles\AnyDesk",
    "${env:ProgramFiles(x86)}\AnyDesk"
) | Where-Object { Test-Path $_ }
if ($anydeskProc -or $anydeskPaths) {
    $report += [pscustomobject]@{Check="AnyDesk_Presence"; Result="Process: $($anydeskProc.Path -join ', ') | Paths: $($anydeskPaths -join ', ')"; Severity="HIGH"}
}

# 3. Suspicious scheduled tasks (persistence mechanism)
Write-Host "[*] Enumerating scheduled tasks executing from user-writable paths..." -ForegroundColor Cyan
$susTasks = Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object {
    $task = $_
    $_.Actions | Where-Object {
        $_.Execute -match "AppData|Temp|ProgramData|Users\\Public" -and
        $_.Execute -notmatch "Microsoft|Windows"
    } | ForEach-Object {
        [pscustomobject]@{ TaskName=$task.TaskName; TaskPath=$task.TaskPath; Execute=$_.Execute; Arguments=$_.Arguments }
    }
}
if ($susTasks) { $report += [pscustomobject]@{Check="Suspicious_ScheduledTask"; Result=($susTasks | Format-Table | Out-String); Severity="HIGH"} }

# 4. Malware hash sweep (OTX pulse indicators)
$targetHashes = @(
    "0dc0fa727f900ed5033f46f8ba6cf2d97d20ab95fd334cabc0f216da6e0622b0",
    "12648cd9d425f78db2dbc6e03c14f11e6ac6aadf8b3975c23cce9519e2b58d33",
    "47854deb456cb08c651b7f9ae2f9d87c72d0719de6af233340632efb3c1980f4",
    "f57e010541fb4ccbf23aefc4a827f753a6ff3f8792d9c04c3eea83f6963c6bae"
)
Write-Host "[*] Sweeping Downloads/Desktop/Temp for known-bad hashes..." -ForegroundColor Cyan
$sweepPaths = @("$env:USERPROFILE\Downloads","$env:USERPROFILE\Desktop","$env:TEMP","C:\Users\Public")
foreach ($p in $sweepPaths) {
    if (Test-Path $p) {
        Get-ChildItem $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            try {
                $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction Stop).Hash.ToLower()
                if ($targetHashes -contains $h) {
                    $report += [pscustomobject]@{Check="Malware_Hash_Match"; Result="$($_.FullName) [$h]"; Severity="CRITICAL"}
                }
            } catch {}
        }
    }
}

# 5. Active SMTP egress from non-mail processes
Write-Host "[*] Checking outbound SMTP connections..." -ForegroundColor Cyan
$smtp = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemotePort -in 25,465,587 } |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        [pscustomobject]@{ Process=$proc.Name; Path=$proc.Path; RemoteIP=$_.RemoteAddress; Port=$_.RemotePort }
    } | Where-Object { $_.Process -notmatch "OUTLOOK|thunderbird" }
if ($smtp) { $report += [pscustomobject]@{Check="SMTP_Egress"; Result=($smtp | Format-Table | Out-String); Severity="HIGH"} }

# Output
Write-Host "`n========== HUNT RESULTS ==========" -ForegroundColor Yellow
if ($report.Count -eq 0) { Write-Host "[+] No indicators found." -ForegroundColor Green }
else { $report | Format-List; $report | Export-Csv -Path ".\RareWerewolf_Hunt_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation }