Sticky Werewolf
Also known asAngry Likho · MimiStick · PhaseShifters
Summary
Cyber-espionage group (assessed pro-Ukrainian by F6) targeting Russia and Belarus since April 2023. Expanded from government agencies to aviation (OKB Kristall aircraft/spacecraft manufacturer), pharmaceutical companies, and research institutes. Phishing campaigns impersonate the general director of AO OKB Kristall using password-protected archives containing LNK files and fake PDF decoys. Delivers commodity RATs (Rhadamanthys, Ozone RAT) purchased from illicit marketplaces rather than custom tooling. Morphisec identified the group in 2024.
Attribution
Assessed pro-Ukrainian by F6; no state attribution
Tracked by researchers; no state or organisation has been publicly attributed.
- F6 (F.A.C.C.T.) (Research, 2025-01-15)
A pro-Ukrainian cyber-espionage group
Campaigns 3
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Minpromtorg 'convict labour for defence orders' lure — Ozone RAT | 2024-12 – 2025-01 | Russia | Defence Industry, Research, Manufacturing | F6 / F.A.C.C.T. (2025-01-15) — phishing posing as Russia's Ministry of Industry and Trade, intercepted 13 Jan 2025 (test mail 23 Dec 2024); 'Форма заполнения.pdf.exe' installs Ozone RAT |
| Angry Likho — NSIS SFX implant delivering Lumma Stealer | 2024-06 – 2025-01 | Russia, Belarus | Government, Government contractors | Kaspersky (2025-02-21) — new attacks from June 2024, payloads in Jan 2025; hundreds of victims in Russia, several in Belarus |
| Russian aviation targeting — AO OKB Kristall lures (Morphisec) | 2024 – 2024-06 | Russia, Belarus | Aviation | Morphisec Labs (2024-06-06) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 3
| Initial Access1 | T1566.001Spearphishing Attachment |
|---|---|
| Execution1 | T1204.002Malicious File |
| Stealth1 | T1027Obfuscated Files or Information |
Malware and tools 4
| Name | Description | Platform |
|---|---|---|
| Rhadamanthys | Commodity Infostealer | Windows |
| Ozone RAT | Commodity RAT | Windows |
| Lumma Stealer | Commodity infostealer | Windows |
| DarkTrack RAT | Commodity RAT | Windows |
Infrastructure patterns
- Payloads hosted on WebDAV servers, reached from LNK files (Morphisec, 2024)