Loading threat actor…
Awaken Likho, also known as Core Werewolf, is an espionage-focused threat cluster active since at least 2021 that primarily targets organizations in Russia and Belarus. Its victimology centers on government institutions and related contractors, with additional targeting reported against the energy sector and defense-industrial organizations. The group is associated with the broader Likho activity cluster and is characterized by Russian-language spearphishing lures, compact operational infrastructure, and a sustained focus on document and user-data theft. Awaken Likho commonly gains initial access through phishing emails carrying self-extracting archives and decoy documents. Earlier operations relied heavily on legitimate remote administration and file-transfer tools such as UltraVNC, MeshAgent, MeshCentral, and Rclone, using them for reconnaissance, remote access, malware delivery, and exfiltration. More recent activity shows a shift toward custom malware development. Observed tooling includes an AutoIt-based lightweight backdoor or loader and the C++ backdoors TokenBuoy and TokenBuoySH. These implants support host reconnaissance, command execution, payload delivery, telemetry collection, and staged follow-on access. TokenBuoySH additionally supports victim-specific configuration, registry-stored settings, HTTP- and SSH-based tasking, file transfer, and self-destruction behavior. The group’s tradecraft emphasizes stealth and operator control rather than noisy automation. Reported behaviors include environment checking, anti-analysis measures, self-deletion, selective second-stage deployment, and use of legitimate interpreters or administration software to blend with normal activity. Awaken Likho has been observed collecting system information, enumerating files, executing shell commands, deploying additional payloads, and exfiltrating documents from compromised hosts. The actor has also been linked to destructive post-exfiltration activity through use of the Goodbye-wiper. Overall, Awaken Likho is best understood as a Russia- and Belarus-focused cyber-espionage actor that has evolved from abuse of legitimate tools toward tailored malware while maintaining phishing-led intrusions and data theft as core operational patterns.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
24 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
68 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting phishing-led intrusions against Russian and Belarusian government organizations, using custom backdoors TokenBuoy and TokenBuoySH for system reconnaissance, command execution, telemetry collection, file theft, and exfiltration, alongside Rclone and previously legitimate remote administration tools.
Conducting cyber-espionage campaigns primarily against organizations in Russia and Belarus, especially government institutions and contractors, using targeted phishing, self-extracting 7-Zip archives, AutoIt-based implants, and previously legitimate remote administration tools such as UltraVNC.
Espionage-focused group targeting government, energy, and defense sectors; also conducts destructive follow-on activity using a custom wiper after exfiltration.
Related Likho activity cluster whose campaigns share infrastructure and tooling characteristics with Angry Likho, including NSIS self-extracting archives and similar anti-analysis checks in implants.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.