bi.zonePublished
Arcane Werewolf revamps its arsenal with Loki 2.1 implant
Excerpt
In October and November 2025, BI.ZONE Threat Intelligence observed malicious activity by Arcane Werewolf (Mythic Likho) targeting Russian manufacturing enterprises. Retrospective analysis suggests that the threat actor most likely used phishing emails as the initial access vector, consistent with its previous campaigns. The messages were irrecoverable but presumably contained links to a malicious archive hosted on the attackers’ C2 server. The links directed victims to a spoofed website imitating a Russian manufacturing company.
Adversaries often send phishing emails impersonating major or well‑known organizations, as well as national regulators, or reference them for…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by bi.zone on bi.zone.
On the same topics
- Star Blizzard refines phishing and malware delivery with the RedFlick techniqueMicrosoft · Published 29 Sep
- Introducing LX RAT: ITR Phishing Targets Finance and Techzerobec.com · Published 11 Jun
- Analysis of a Phishing Email Attack Case by the Larva-24009 Threat ActorAhnLab · Published 2 Aug
- TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel IndustryTrend Micro · Published 29 Jun
