AI-Generated Decoys & XLL Stealth: Inside the New “EchoGather” Cyber Espionage Campaign

A cyber-espionage group known for hunting Russian organisations has upgraded its arsenal, deploying malicious Excel add-ins to slip past defenses and install a new backdoor. A new report from Intezer reveals that the Paper Werewolf group (also known as GOFFEE) has adopted XLL files—a specialised type of Windows DLL used by Excel—to deliver a stealthy implant dubbed EchoGather.

The campaign, detected in late October 2025, marks a significant shift in tactics for the group, combining classic email lures with novel execution methods to target Russia’s high-tech and defence industries. The decoy documents masquerade as official letters from the Russian Ministry of Industry and Trade and are AI-generated, with several noticeable inconsistencies such as misspelled Russian words and a distorted emblem.

The malware’s loader waits until a thread exits to trigger the payload, a technique intended to evade detection, and EchoGather then provides reconnaissance and persistence with a hardcoded C2 server and command execution capabilities. Researchers linked the activity to Paper Werewolf based on shared infrastructure, including the ruzeda .com domain and the exploitation of a WinRAR vulnerability (CVE-2025-8088).