Paper Werewolf/GOFFEE is a threat campaign tracked across 1 threat cluster and 1 intelligence report mention on ThreatCluster. First observed January 25, 2026; most recent activity January 25, 2026.
Paper Werewolf/GOFFEE is a threat campaign identified for its sophisticated multi-stage phishing against Windows endpoints, featuring Russian-language lures. The operation’s multi-step delivery and Windows exploitation signal a robust initial-access tactic that can lead to payload deployment, making it a significant concern for defenders monitoring phishing-to-malware chains.
A multi-stage phishing campaign is targeting Russian organizations with Amnesia RAT and Hakuna Matata ransomware. The attackers use social engineering tactics to deliver malicious files disguised as business documents,…