Armored LikhoThreat actor
- eagle werewolf
Armored Likho is an APT group targeting government agencies and the electric power sector across Russia, Brazil, and Kazakhstan. Their operations blend financially motivated campaigns with cyber-espionage, utilizing obfuscated, modular RATs and infostealers designed to evade dynamic analysis.From MISP Galaxy
Last reported 1 month ago, by AhnLab ASEC3 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1105Ingress Tool Transfer
“Script-based execution (such as PowerShell, VBScript, CMD, and JavaScript), obfuscation, ingress tool transfer, HTTP/HTTPS-based C2 communication, local system data collection, and data exfiltration via C2 paths were repeatedly observed.”
- T1195Supply Chain Compromise
“… APT Threat Trends report summarizes attack cases in which state-sponsored threat actors combined attacks involving open-source supply chain compromises, the use of generative AI, the exploitation of legitimate cloud services, job scams, and the exploitation of zero-day vulnerabi…”
- T1221Template Injection
“Viceroy Tiger (Donot) targeted Bangladeshi military and defense officials using remote template injection and a multi-stage shellcode loader.”
- T1684Social Engineering
“…rs and financially motivated attackers are employing a combination of supply chain attacks, account takeovers, cloud breaches, and social engineering techniques.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
August 2026 Threat Trend Report on APT Groups“Armored Likho, Awaken Likho, Core Werewolf, Dark Caracal, Darkhotel, Head Mare, and OceanLotus (APT32) also carried out attacks exploiting legitimate services and software such as Telegram, GitLab, GitHub, OneDrive, TrueConf, and Sogou Input Method, respectively.”
-
July 2026 Threat Trend Report on APT Groups“Armored Likho deployed the BusySnake stealer to harvest browser credentials, cookies, documents, screen information, and reverse SSH tunnels.”
-
July 2026 CVE Landscape“… embedded-device flaws to build DDoS and relay infrastructure; Cloud Atlas abused Microsoft Equation Editor to deliver CloudAtlasGo; Armored Likho used a malicious Windows shortcut to deploy BusySnake Stealer; and JADEPUFFER and Cl0p targeted exposed AI and product-lifecycle plat…”
Indicators in its reports
named in the reports above- joomlacontenteditor[.]netin 1 report
Copy this indicator · defanged
Thanks — we review every report.