APT GroupSOCRadar source-of-truth import; pending cross-source consensus confidence

Armored Likho

Armored Likho, also tracked as Eagle Werewolf, emerged in May 2023, with its activities publicly detailed by Kaspersky in July 2026. This China-aligned threat group operates with a dual motivation, blending financially driven attacks, such as credential and infostealer operations, with targeted cyber espionage against government agencies and the electric power sector. The group is distinguished by its use of AI-generated loaders, a custom modular infostealer named BusySnake Stealer, and its integration of reverse tunneling capabilities. Notably, it exploits vulnerabilities like CVE-2025-9491 and has demonstrated a pattern of targeting drone and UAV-related organizations, sometimes leveraging compromised Telegram channels for malware distribution.

Directory Briefing

Top 10 Talking Points

Armored Likho should be treated as an intrusion cluster, not a single immutable toolkit.¹

Vendor aliases describe overlapping activity sets; attribution can guide hypotheses, but containment should be driven by the behaviors and access paths actually observed.

Initial access should be scoped across identity and Internet-facing systems.¹

The retained behavior points to Phishing; preserve authentication, VPN, edge-device, email, and remote-administration evidence together.

The first detected host should not define the compromise boundary.¹

Check for earlier credential use, remote sessions, administrative changes, and data access because public actor records often understate the full pre-impact timeline.

Identity compromise is a central scoping issue.¹

Evidence includes credential or account abuse; response should cover privileged, service, remote-access, SaaS, and recovery identities—not just interactive user passwords.

The investigation should distinguish transient execution from durable access.¹

Review accounts, scheduled execution, remote-management tooling, cloud configuration, and externally reachable infrastructure for residual access.

Legitimate administration tools may carry much of the attack.¹

Reported tooling or behavior includes PowerShell, remote execution, or other dual-use administration behavior; detection must distinguish authorized administration from anomalous context and sequence.

The actor may reduce visibility before the main objective is reached.¹

Defense impairment or evidence removal is retained in the source record. Preserve endpoint, identity, network, and cloud telemetry outside the affected environment.

The actor's objective should be inferred from evidence, not the label.¹

Determine whether the intrusion was positioned for espionage, theft, disruption, access resale, or a later-stage operation before briefing impact.

Victimology helps prioritize business processes, not prove attribution.¹

Retained targeting includes Energy & Utilities, Manufacturing, Public Administration, and Space & Defense across Brazil, Kazakhstan, and Russian Federation; translate those sectors into the organization's exposed systems and high-value data.

The first briefing should separate containment confidence from attribution confidence.¹

State what access is confirmed, what persistence has been closed, what information may have been collected, and which attribution judgments remain source-bound.

Bottom Line Up Front

BLUF

Armored Likho should be treated as an intrusion cluster, not a single immutable toolkit.¹

Vendor aliases describe overlapping activity sets; attribution can guide hypotheses, but containment should be driven by the behaviors and access paths actually observed.

Initial access should be scoped across identity and Internet-facing systems.¹

The retained behavior points to Phishing; preserve authentication, VPN, edge-device, email, and remote-administration evidence together.

The first detected host should not define the compromise boundary.¹

Check for earlier credential use, remote sessions, administrative changes, and data access because public actor records often understate the full pre-impact timeline.

Identity compromise is a central scoping issue.¹

Evidence includes credential or account abuse; response should cover privileged, service, remote-access, SaaS, and recovery identities—not just interactive user passwords.

The investigation should distinguish transient execution from durable access.¹

Review accounts, scheduled execution, remote-management tooling, cloud configuration, and externally reachable infrastructure for residual access.

Legitimate administration tools may carry much of the attack.¹

The actor may reduce visibility before the main objective is reached.¹

Defense impairment or evidence removal is retained in the source record. Preserve endpoint, identity, network, and cloud telemetry outside the affected environment.

The actor's objective should be inferred from evidence, not the label.¹

Determine whether the intrusion was positioned for espionage, theft, disruption, access resale, or a later-stage operation before briefing impact.

Victimology helps prioritize business processes, not prove attribution.¹

The first briefing should separate containment confidence from attribution confidence.¹

State what access is confirmed, what persistence has been closed, what information may have been collected, and which attribution judgments remain source-bound.

Decision Context

Executive Summary

Actor Card Detail

Actor Profile

Entity Type¹

APT Group profile

First Seen¹

2023-05-01

Last Seen¹

2026-07-03

Origin¹

Motivation¹

APT Group activity retained from SOCRadar

Primary Access Pattern¹

T1573 - Encrypted Channel

Objective¹

APT Group activity retained from SOCRadar

Victimology

Named Victims / Public Disclosures

No named victim organizations are retained in the cited source artifacts for this profile. Countries and sectors are targeting context, not victim identities.

Identity

Aliases And Boundaries

Aliases¹

Eagle Werewolf

Source Boundary

SOCRadar is the retained baseline for this profile. IntelliOS preserves source labels as discovery and comparison signals until a cited source explicitly supports a merge, split, or actor-boundary change.

Targeting

Targets, Activity, And ATT&CK

Target Countries / Exposure¹

BrazilKazakhstanRussian Federation

Target Sectors¹

Energy & UtilitiesManufacturingPublic AdministrationSpace & Defense

Associated Activity¹

Initial Access: Spear-phishing emails with malicious attachments disguised as government notices or social programs, leading to the distribution of RAR archives containing EXE binaries or LNK files.Execution & Persistence: Creation of scheduled tasks named 'WindowsHelper' or similar, configured to run every five minutes, along with dropping Python 3.12 runtimes in AppData paths.Defense Evasion: Obfuscated PowerShell commands spawned from Explorer.exe via LNK file execution and deployment of PyArmor Pro-protected BusySnake Stealer with dynamic bytecode decryption and re-encryption.Command and Control: Outbound SSH tunnel connections established by Go2Tunnel or integrated BusySnake functionality, and HTTP GET requests to C2 with browser-mimicking User-Agent and function names for commands.Discovery & Collection: Clipboard data harvesting, file system enumeration, logging metadata to a local database, and screenshot capture.

ATT&CK IDs¹

T1573 - Encrypted ChannelT100 - Data from Local SystemT1566 - PhishingT1204.002 - User ExecutionT1027 - Obfuscated Files or Information

Campaign Context

Associated Campaigns / Operations

No source-backed campaign or named operation association is currently retained for this actor card. Related campaign rows will appear here when SOCRadar, MITRE ATT&CK Campaigns, Microsoft, Google/Mandiant, CrowdStrike, CISA, or another retained public source ties the actor to a named campaign or operation.

Indicators

IOCs And Observable Retention

SOCRadar reported 0¹IntelliOS retained 0

No public IOC values are currently retained in IntelliOS for this profile. Future enrichment can add cited observables from SOCRadar, Microsoft threat intelligence, Google/Mandiant, CrowdStrike, MITRE CTI, CISA, vendor reports, and other reliable open sources.

Source coverage: 1 source group tracked; 0 currently contribute retained observable or context rows.

Retained Public Observables¹

Source	Reported	Retained	Coverage Status
SOCRadar¹	0	0	Profile retained; no SOCRadar IOC count currently stored.

Actor Chronology

Observed Activity Timeline

No source-backed actor-activity dates are currently retained. Publication and record-maintenance dates are not promoted into activity dates.

IntelliOS Intel Products

Linked Products

None Found

Source Integrity AppendixSource reconciliation, citations, and collision-boundary analysisOpen

Source Reconciliation

How IntelliOS Keeps The Labels Straight

Source	Primary Name	Treatment	Boundary
SOCRadar	Armored Likho	Baseline actor-card record retained for the current profile view.	Fields reflect the retained database record. Additional source consensus, collisions, and canonical identity mappings can be layered into this profile without automatically merging actors.
IntelliOS	Armored Likho	Normalizes this record for directory search, card display, profile lookup, and future product linking.	Normalization is a presentation and workflow aid; it is not an independent attribution claim.

Open retained source profile

Source Collision Notes

Open Interpretation Boundaries

IntelliOS starts this detail page from the retained source record for Armored Likho.

No possible same-actor, alias reuse, sub-cluster, duplicate-boundary, or external-source collision is currently retained for this actor.

Collision Source	Candidate Records	Shared Evidence	Treatment
None retained	No candidate records	No shared evidence recorded	No collision action needed.
External sources	Mandiant, CrowdStrike, other non-SOCRadar sources	None retained	External collisions are shown separately when retained.

Citations

Source Notes

#	Source	Use In Card
1	SOCRadar Threat Actor Database https://socradar.io/free-tools/threat-actor	Threat actor directory source for profile fields and reported activity.

Loading Threat Actor Cards

Armored Likho

Top 10 Talking Points

Armored Likho should be treated as an intrusion cluster, not a single immutable toolkit.1

Initial access should be scoped across identity and Internet-facing systems.1

The first detected host should not define the compromise boundary.1

Identity compromise is a central scoping issue.1

The investigation should distinguish transient execution from durable access.1

Legitimate administration tools may carry much of the attack.1

The actor may reduce visibility before the main objective is reached.1

The actor's objective should be inferred from evidence, not the label.1

Victimology helps prioritize business processes, not prove attribution.1

The first briefing should separate containment confidence from attribution confidence.1

BLUF

Armored Likho should be treated as an intrusion cluster, not a single immutable toolkit.1

Initial access should be scoped across identity and Internet-facing systems.1

The first detected host should not define the compromise boundary.1

Identity compromise is a central scoping issue.1

The investigation should distinguish transient execution from durable access.1

Legitimate administration tools may carry much of the attack.1

The actor may reduce visibility before the main objective is reached.1

The actor's objective should be inferred from evidence, not the label.1

Victimology helps prioritize business processes, not prove attribution.1

The first briefing should separate containment confidence from attribution confidence.1

Executive Summary

Actor Profile

Named Victims / Public Disclosures

Aliases And Boundaries

Targets, Activity, And ATT&CK

Associated Campaigns / Operations

IOCs And Observable Retention

Observed Activity Timeline

Linked Products

How IntelliOS Keeps The Labels Straight

Open Interpretation Boundaries

Source Notes

Armored Likho should be treated as an intrusion cluster, not a single immutable toolkit.¹

Initial access should be scoped across identity and Internet-facing systems.¹

The first detected host should not define the compromise boundary.¹

Identity compromise is a central scoping issue.¹

The investigation should distinguish transient execution from durable access.¹

Legitimate administration tools may carry much of the attack.¹

The actor may reduce visibility before the main objective is reached.¹

The actor's objective should be inferred from evidence, not the label.¹

Victimology helps prioritize business processes, not prove attribution.¹

The first briefing should separate containment confidence from attribution confidence.¹

Armored Likho should be treated as an intrusion cluster, not a single immutable toolkit.¹

Initial access should be scoped across identity and Internet-facing systems.¹

The first detected host should not define the compromise boundary.¹

Identity compromise is a central scoping issue.¹

The investigation should distinguish transient execution from durable access.¹

Legitimate administration tools may carry much of the attack.¹

The actor may reduce visibility before the main objective is reached.¹

The actor's objective should be inferred from evidence, not the label.¹

Victimology helps prioritize business processes, not prove attribution.¹

The first briefing should separate containment confidence from attribution confidence.¹