Armored Likho is an APT group known for cyber-espionage and financially motivated operations targeting government and energy sectors.
Analyst brief
Armored Likho, also known as Eagle Werewolf, is an APT group targeting government agencies and the electric power sector in Russia, Brazil, and Kazakhstan. This actor blends financially motivated operations with cyber-espionage, using obfuscated, modular RATs and infostealers designed to evade dynamic analysis. Their TTPs include spear-phishing emails with deceptive themes for initial access, distributing malicious attachments, and leveraging tools like BusySnake Stealer and AquilaRAT while employing AI for payload generation. Defenders should heighten email security awareness, monitor for modular RAT behaviors, and focus on detecting unusual patterns indicative of AI-generated payloads.
Armored Likho
Eagle Werewolf
activeunknown
Armored Likho is an APT group targeting government agencies and the electric power sector across Russia, Brazil, and Kazakhstan. Their operations blend financially motivated campaigns with cyber-espionage, utilizing obfuscated, modular RATs and infostealers designed to evade dynamic analysis. They employ spear-phishing emails with deceptive themes to gain initial access, distributing malicious attachments that mimic legitimate content. Their toolkit includes BusySnake Stealer and AquilaRAT, with a focus on evolving TTPs and leveraging AI tools for payload generation.