Loading threat actor…
Arcane Werewolf, also tracked as Mythic Likho, is a cyber-espionage threat cluster identified in 2025 and associated with intrusions against Russian organizations. Reported targeting has included Russian manufacturing enterprises, government agencies, telecom-related entities, and other companies across multiple sectors. The group has been linked to phishing-led intrusion chains that use spoofed websites and malicious archives to deliver payloads, often relying on LNK files, PowerShell, and decoy documents to initiate execution while masking malicious activity. The actor is notable for using malware and agents compatible with the Mythic command-and-control framework, including Merlin and the custom Loki malware family. Observed Loki variants include Loki 2.0 and Loki 2.1. These loaders profile compromised hosts, collecting information such as operating system details, usernames, hostnames, and network information, then encrypt and exfiltrate that telemetry to command-and-control infrastructure. Loki 2.1 has been observed supporting a broad post-compromise command set including file transfer, process creation, process termination, code injection, token-related actions, environment discovery, and execution of additional payloads, and has been described as compatible with both Mythic and Havoc. Campaigns have also used droppers written in Go and C++, embedded payloads, and local implant decryption and execution within loader memory. Operationally, Arcane Werewolf has used phishing for initial access, host reconnaissance, encrypted exfiltration, and post-exploitation tooling consistent with long-term intelligence collection rather than disruptive or extortion-driven operations. Available reporting characterizes the cluster as focused on collecting confidential information from Russian targets. Mythic Likho is also described as a cluster within the broader Likho naming family. No high-confidence public attribution to a specific state sponsor or country of origin is currently available.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
31 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 malware families attributed to this actor across reporting.
33 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Espionage-focused APT targeting government institutions and telecommunications, using Merlin agent and LNK-file based infection chains.
APT espionage cluster within the Likho family targeting Russian organizations; publicly associated with use of the Mythic C2 framework, with likely phishing delivery and PowerShell-based post-exploitation, though the article notes limited public campaign detail.
Arcane Werewolf is actively conducting targeted phishing campaigns against Russian manufacturing companies, deploying a new version of its custom malware Loki 2.1, which is integrated with the Mythic and Havoc post-exploitation frameworks. The group uses sophisticated phishing techniques and custom malware to gain access, exfiltrate data, and maintain control over compromised systems.
Targeting Russian manufacturing companies with phishing and custom malware for espionage and data theft.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.