Loading threat actor…
Sticky Werewolf is a pro-Ukrainian cyber-espionage threat group known for phishing-led intrusions against Russian organizations, particularly government institutions, research institutes, and industrial enterprises associated with the defense-industrial sector. Reporting also links the group to targeting in Belarus and Poland. Known aliases include Angry Likho, MimiStick, and PhaseShifters. The group commonly relies on spearphishing for initial access, using spoofed messages themed around Russian state bodies and official business processes. Observed lures have impersonated entities such as the Ministry of Industry and Trade, EMERCOM, the Ministry of Construction, and the FSB. Delivery chains have included malicious attachments as well as phishing links designed to appear legitimate while also collecting victim telemetry for profiling and filtering. Sticky Werewolf has been associated with remote-access and information-stealing malware including Ozone RAT, Darktrack RAT, Glory Stealer, and MetaStealer. Ozone RAT has been used as a modular remote-access trojan capable of persistence, reflective loading of its main module, remote command execution, file and process management, registry modification, keylogging, screen and webcam capture, microphone recording, password recovery, reverse-proxy functionality, payload download and execution, and self-deletion. Campaigns have also shown use of decoy documents and disguised executables to conceal malware installation from victims. The actor’s tradecraft demonstrates reconnaissance and defense-evasion elements in addition to initial compromise and post-exploitation. Use of victim telemetry collection through phishing infrastructure has enabled profiling of targets and exclusion of unwanted environments such as sandboxes or researchers. Persistence through startup mechanisms and protected or obfuscated malware components has also been observed. Overall, Sticky Werewolf is best characterized as a politically aligned espionage actor focused on collecting access and intelligence from Russian state, research, and defense-related organizations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
30 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 malware families attributed to this actor across reporting.
15 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting phishing-based initial access campaigns delivering trojanized .exe or .scr files disguised as documents, then installing Ozone RAT or Darktrack RAT for remote access, persistence, profiling of victims, and post-compromise surveillance/control.
Pro-Ukrainian hacking group whose tactics are being mimicked by PseudoSticky; no direct activity details beyond being the template for mimicry in this content.
Referenced as a Ukrainian APT whose tactics are being mimicked by another cluster (PseudoSticky); no direct activity details provided in this content.
Pro-Ukrainian cyber-espionage group conducting phishing campaigns against Russian scientific-production enterprises, government institutions, research institutes, and defense-industrial organizations, using spoofed emails impersonating Russian ministries to deliver remote access trojans and stealers.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.