Armored Likho
MISP
Type:
Unknown
Unknown
Country:
Unknown
Unknown
First seen:
Unknown
Unknown
Details:
Armored Likho is an APT group targeting government agencies and the electric power sector across Russia, Brazil, and Kazakhstan. Their operations blend financially motivated campaigns with cyber-espionage, utilizing obfuscated, modular RATs and infostealers designed to evade dynamic analysis. They employ spear-phishing emails with deceptive themes to gain initial access, distributing malicious attachments that mimic legitimate content. Their toolkit includes BusySnake Stealer and AquilaRAT, with a focus on evolving TTPs and leveraging AI tools for payload generation.
References (1)
Aliases (25)
Eagle Werewolf
Eagle Werewolf
Eagle Werewolf
Eagle Werewolf
Eagle Werewolf
Eagle Werewolf
Eagle Werewolf
Eagle Werewolf
Eagle Werewolf
Eagle Werewolf
Eagle Werewolf
Eagle Werewolf
Eagle Werewolf
Eagle Werewolf
Eagle Werewolf
Eagle Werewolf
Eagle Werewolf
Eagle Werewolf
Eagle Werewolf
Eagle Werewolf
Eagle Werewolf
Eagle Werewolf
Eagle Werewolf
Eagle Werewolf
Eagle Werewolf
Metadata
| ID: | 1092 |
| Created: | 27/07/2026 16:00 |
| Updated: | 08/08/2026 16:00 |