New CoreRAT Malware Gives Core Werewolf Hackers Full Control of Compromised Systems

A new remote access trojan called CoreRAT is giving the Core Werewolf threat group a way to take over infected Windows systems. The malware appeared in campaigns observed from June through July 2026, though evidence shows it has been active since at least March. Its arrival marks an expansion of the group’s toolkit. The attackers used phishing...