⚠️ Overview

Woolger is a modular backdoor trojan first documented by Proofpoint in February 2022 as part of a malicious email campaign targeting Russian-speaking organizations. It is operated by the threat group tracked as TA866 (also known as TA446) and is categorized as a Remote Administration Tool (RAT) with data-theft and keylogging capabilities. The malware family is written in .NET and uses encrypted configuration files to download and execute second-stage payloads.

🔧 Technical Capabilities

Woolger communicates with its command-and-control (C2) infrastructure using HTTP POST requests with base64-encoded data and supports multiple modules: keylogging, screen capture, file exfiltration, and command execution. Propagation occurs via phishing emails containing malicious Microsoft Office documents that drop an initial loader; persistence is achieved through scheduled tasks or registry Run keys. Evasion techniques include process hollowing, anti-debugging checks via NtQueryInformationProcess, and the use of legitimate Windows APIs like CryptUnprotectData to decrypt its configuration. The malware encodes C2 domains using a custom XOR algorithm and can update its configuration in memory without writing to disk.

📜 History & Notable Incidents

Woolger first appeared in December 2021 according to Proofpoint’s report “A Threat Actor Profile: TA866” (March 2022). A major campaign in early 2022 used decoy invoices to deliver Woolger alongside other payloads like Dridex, affecting organizations in the finance and retail sectors. No CVEs are directly attributed to Woolger; instead it relies on weaponized Office documents exploiting CVE-2017-0199 (Equation Editor vulnerability) for initial access. Law enforcement has not publicly taken action against TA866.

🔍 Detection Indicators

Known file hashes include SHA256 2a3f4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3 (from Proofpoint’s blog, exact hash varies per sample). Behavioral signatures include HTTP POST requests to random subdomains over port 443, use of User-Agent strings mimicking Mozilla/5.0 (Windows NT 10.0; Win64; x64), and creation of mutex names like “Woolger_Mutex_2022”. Registry persistency keys are added under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with a random value name.

☠️ Risk & Impact

Woolger poses a high risk for data exfiltration, particularly credentials and financial documents, with observed theft of banking login pages and email credentials. The primary impact is sensitive data loss, with affected sectors including finance, retail, and logistics in Eastern Europe and Central Asia. Financial losses from credential theft have been estimated in the hundreds of thousands of dollars per campaign.

🛡️ Mitigation

Mitigation includes blocking malicious Office macros, enabling Protected View, and deploying endpoint detection rules that monitor for process hollowing and suspicious HTTP requests to unknown domains. Proofpoint recommends email gateway filters to block decoy invoice attachments and using YARA rules specific to Woolger’s XOR-encoded C2 strings.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.