Eagle Werewolf

Eagle Werewolf is an espionage-focused threat cluster tracked as active since at least May 2023. According to the provided reporting, it primarily targets state organizations, industrial companies, and individuals involved in drone/UAV manufacturing and engineering. Activity linked to the cluster was identified in February 2026 in a Starlink device registration-themed campaign, and related infrastructure hosted on Iraq-based Regxa was associated with phishing lures themed around Starlink registration and drone training. The cluster uses phishing and compromised Telegram channels for initial access and malware delivery. In the February 2026 activity, Eagle Werewolf distributed a ZIP archive containing a Rust dropper disguised as a Starlink activation or checklist application. The Rust dropper, built with the Tauri framework, decrypted and launched a Go dropper, registered the victim machine with command-and-control infrastructure, and collected Starlink-related victim data through its GUI. The Go dropper unpacked scripts and binaries, created a hidden local user with a generated password, attempted to add that user to the Administrators group, hid the account from the Windows logon screen, and prepared SSH tunnel configuration. It deployed AquilaRAT as the MicrosoftOfficeUpdate service and supported SSH tunneling through Go2Tunnel. AquilaRAT is described in the content as a previously undocumented Rust RAT/backdoor that communicated with infrastructure including updateserv[.]net and servupdate[.]net, polled its C2 regularly, and supported heartbeat, command execution, file upload, file scanning, and related remote access tasks. Go2Tunnel registered with C2 at 145.223.70[.]69 to obtain tunnel parameters and launched a reverse SSH tunnel to expose local port 22. The malware arsenal directly associated with Eagle Werewolf in the content includes a Rust dropper, a Go dropper, Go2Tunnel, and AquilaRAT. No additional aliases or sub-groups beyond Eagle Werewolf are directly provided in the content.