Security experts from Seqrite have exposed a targeted phishing operation aimed at Russian aerospace and electronics companies. The attackers send emails impersonating a state institution, complete with forged invoices and the logo of Russia's Ministry of Industry and Trade. These messages contain password-protected RAR files that, when opened with the provided password, unleash a chain of malicious scripts leading to the installation of portable AnyDesk software configured for unattended remote access. The malware also sets up persistence through scheduled tasks and exfiltrates configuration data using legitimate email tools while hiding its activity. This campaign is linked to the threat group known as Rare Werewolf (also called Librarian Ghouls), which focuses on high-value industrial targets in the region.