SYMBOLCOMMON_NAMEaka. SYNONYMS

Angry Likho  (Back to overview)

aka: Sticky Werewolf

Angry Likho is an APT group that has been active since 2023, primarily targeting large organizations and government agencies in Russia and Belarus. Their attacks typically involve spear-phishing emails with malicious attachments, such as RAR archives, and utilize a known payload, the Lumma stealer, for data exfiltration. The group employs a compact infrastructure and has been linked to espionage activities, particularly in sectors like aviation and pharmaceuticals. Their operations have shown a focus on collecting sensitive information, including cryptowallet files and user credentials.

Associated Families
win.lumma
References
2026-05-19 ⋅ Microsoft ⋅ Steven Masada
Disrupting Fox Tempest: A cybercrime service that turned “verified” software into a pathway for ransomware
Akira INC Qilin Rhysida AgendaCrypt Akira Broomstick INC Lumma Stealer Rhysida Vidar Fox Tempest
2026-05-19 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
Exposing Fox Tempest: A malware-signing service operation (Podcast)
Akira Rhysida Akira BlackByte BlueSky Broomstick Lumma Stealer Rhysida Spyder Vidar Fox Tempest
2026-05-19 ⋅ The Record ⋅ Jonathan Greig
Microsoft disrupts Fox Tempest malware-signing-as-a-service platform tied to ransomware gangs
Akira INC Qilin Rhysida AgendaCrypt Akira Broomstick INC Lumma Stealer Rhysida Vidar Fox Tempest
2026-04-07 ⋅ Gen Digital ⋅ Jan Rubín, Vojtěch Krejsa
Remus: Unmasking The 64-bit Variant of the Infamous Lumma Stealer
Lumma Stealer Remus Tenzor
2026-03-26 ⋅ Darktrace ⋅ Isabel Evans
Phantom Footprints: Tracking GhostSocks Malware
GhostSocks Lumma Stealer
2026-03-24 ⋅ Zynap ⋅ Alberto Marín
Defensive Rootkits: Engineering Kernel-Level Malware Analysis from Ring 0
Xloader CloudEyE Lumma Stealer SmokeLoader
2026-02-11 ⋅ Bitdefender ⋅ Bogdan Ionut Lazar, Janos Gergo Szeles, Manuel Dragomir
LummaStealer Is Getting a Second Life Alongside CastleLoader
CASTLELOADER Lumma Stealer
2025-11-13 ⋅ Trend Micro ⋅ Junestherry Dela Cruz, Sarah Pearl Camiling
Increase in Lumma Stealer Activity Coincides with Use of Adaptive Browser Fingerprinting Tactics
Lumma Stealer Water Kurita
2025-10-16 ⋅ Trendmicro ⋅ Junestherry Dela Cruz
Shifts in the Underground: The Impact of Water Kurita’s (Lumma Stealer) Doxxing
Lumma Stealer Water Kurita
2025-10-01 ⋅ SpyCloud ⋅ James
Bifrost Burned: Dissecting Asgard Protector’s Defenses
Lumma Stealer
2025-09-30 ⋅ Synthient ⋅ Synthient
GhostSocks: From Initial Access to Residential Proxy
GhostSocks Lumma Stealer
2025-07-27 ⋅ Cyber Intelligence Insights ⋅ Vasilis Orlof
Bulletproof Hosting Hunt: Connecting the dots from Lumma to Qwins Ltd (ASN 213702)
Lumma Stealer
2025-07-27 ⋅ Medium RaghavtiResearch ⋅ BeGoodToAll
Lumma Stealer — A Proliferating Threat in the Cybercrime Landscape
Lumma Stealer
2025-06-24 ⋅ Certego ⋅ Federico Fantini
Malware Analysis - Inside Lumma Stealer
Lumma Stealer
2025-06-24 ⋅ Bridewell ⋅ Bridewell
2025 Cyber Threat Intelligence Report
AsyncRAT Brute Ratel C4 Cobalt Strike Fog Ghost RAT Lumma Stealer Meduza Stealer Quasar RAT RedLine Stealer Sliver
2025-06-18 ⋅ Elastic ⋅ Salim Bitam
A Wretch Client: From ClickFix deception to information stealer deployment
HijackLoader Lumma Stealer SectopRAT
2025-05-21 ⋅ Microsoft ⋅ Steven Masada
Disrupting Lumma Stealer: Microsoft leads global action against favored cybercrime tool
Lumma Stealer
2025-05-20 ⋅ Europol ⋅ Europol
Europol and Microsoft disrupt world’s largest infostealer Lumma
Lumma Stealer
2025-05-09 ⋅ Sophos X-Ops ⋅ Andrew Petrus, Ben Goldberg, Haigh Minassian, Imane Ismail, Sushmita Shetty
Lumma Stealer, coming and going
Lumma Stealer
2025-04-30 ⋅ Google Cloud Community ⋅ Praveeth DSouza
Finding Malware: Unveiling LUMMAC.V2 with Google Security Operations
Lumma Stealer
2025-04-21 ⋅ Trellix ⋅ Mohideen Abdul Khader
Unmasking the Evolving Threat: A Deep Dive into the Latest Version of Lumma InfoStealer with Code Flow Obfuscation
Lumma Stealer
2025-04-16 ⋅ Sekoia ⋅ Sekoia TDR
Interlock ransomware evolving under the radar
Interlock Berserk Stealer Interlock Lumma Stealer Supper
2025-04-15 ⋅ ⋅ Orange Cyberdefense ⋅ André Henschel, Friedl Holzner
CyberSOC Insights: Analysis of a Black Basta Attack Campaign
Black Basta DarkGate Lumma Stealer
2025-03-22 ⋅ Trend Micro ⋅ Junestherry Dela Cruz
Back to Business: Lumma Stealer Returns with Stealthier Methods
Lumma Stealer Water Kurita
2025-03-14 ⋅ VitalDigitalForensics ⋅ v4ensics
Lumma Stealer – A tale that starts with a fake Captcha
Lumma Stealer
2025-03-14 ⋅ Twitter (@CERTCyberdef) ⋅ Alexandre Matousek, Marine PICHON
Tweet on Emmenhtal v3
Emmenhtal Lumma Stealer Rhadamanthys
2025-03-13 ⋅ Group-IB ⋅ Group-IB
ClickFix: The Social Engineering Technique Hackers Use to Manipulate Victims
Emmenhtal Lumma Stealer
2025-03-12 ⋅ Red Canary ⋅ Red Canary
2025 Threat Detection Report
HijackLoader Lumma Stealer NetSupportManager RAT
2025-03-11 ⋅ Trend Micro ⋅ Cj Arsley Mateo, Darrel Tristan Virtusio, Jacob Santos, Junestherry Dela Cruz, Paul John Bardon
AI-Assisted Fake GitHub Repositories Fuel SmartLoader and LummaStealer Distribution
Lumma Stealer SmartLoader Water Kurita
2025-02-21 ⋅ Kaspersky Labs ⋅ Kaspersky
Angry Likho: Old beasts in a new forest
Lumma Stealer Angry Likho
2025-02-20 ⋅ Infrawatch ⋅ Infrawatch Research Team
GhostSocks - Lumma's Partner In Proxy
GhostSocks Lumma Stealer
2025-02-18 ⋅ Proofpoint ⋅ Proofpoint Threat Research Team
An Update on Fake Updates: Two New Actors, and New Mac Malware
Marcher FAKEUPDATES FrigidStealer Lumma Stealer
2025-02-18 ⋅ Varist ⋅ Kervin Alintanahin
Malvertisements, Fake Captchas and Infostealers
Lumma Stealer
2025-01-30 ⋅ RevEng.AI ⋅ RevEng.AI
One ClickFix and LummaStealer reCAPTCHA’s Our Attention - Part 1
Lumma Stealer
2025-01-27 ⋅ Youtube (MalwareAnalysisForHedgehogs) ⋅ Karsten Hahn
Malware Analysis - Binary Refinery URL extraction of Multi-Layered PoshLoader for LummaStealer
Lumma Stealer
2025-01-23 ⋅ Netskope ⋅ Leandro Froes
Lumma Stealer: Fake CAPTCHAs & New Techniques to Evade Detection
Lumma Stealer
2025-01-13 ⋅ ⋅ Cert-AgID ⋅ Cert-AgID
Analisi di una campagna Lumma Stealer con falso CAPTCHA condotta attraverso domino italiano compromesso
Lumma Stealer
2024-12-30 ⋅ Intrinsec ⋅ CTI Intrinsec
CryptBot: Hunting for initial access vectors
CryptBot Lumma Stealer PrivateLoader
2024-12-28 ⋅ Medium s.lontzetidis ⋅ Efstratios Lontzetidis
Lumma 2024: Dominating the Info-Stealer Market
Lumma Stealer
2024-12-20 ⋅ Ryan Weil ⋅ Ryan Weil
Deobfuscation of Lumma Stealer
Lumma Stealer
2024-12-19 ⋅ SpyCloud ⋅ James
LummaC2 Revisited: What’s Making this Stealer Stealthier and More Lethal
GhostSocks Lumma Stealer
2024-12-17 ⋅ Cybereason ⋅ Elena Odier, Gal Romano, Hema Loganathan, Ralph Villanueva
Your Data Is Under New Lummanagement: The Rise of LummaStealer
Lumma Stealer
2024-12-16 ⋅ Guardio Labs ⋅ Nati Tal
“DeceptionAds” — Fake Captcha Driving Infostealer Infections and a Glimpse to the Dark Side of Internet Advertising
Lumma Stealer
2024-11-18 ⋅ Proofpoint ⋅ Proofpoint Threat Research Team, Selena Larson, Tommy Madjar
Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape
AsyncRAT Brute Ratel C4 DanaBot DarkGate Latrodectus Lumma Stealer NetSupportManager RAT XWorm
2024-11-12 ⋅ Kroll ⋅ George Glass, Ryan Hicks
LUMMASTEALER Delivered Via PowerShell Social Engineering
Lumma Stealer
2024-10-17 ⋅ Loader Insight Agency ⋅ LIA
Correlating Vidar Stealer Build IDs Based on Loader Tasks
Lumma Stealer SmokeLoader Vidar
2024-10-08 ⋅ Trustwave ⋅ Cris Tomboc, King Orande
Pronsis Loader: A JPHP-Driven Malware Diverging from D3F@ck Loader
Pronsis Loader Latrodectus Lumma Stealer
2024-10-05 ⋅ Mandar Naik
Malware Analysis - Lumma Stealer
Lumma Stealer
2024-09-25 ⋅ Medium b.magnezi ⋅ 0xMrMagnezi
Lumma Stealer - Malware Analysis
Lumma Stealer
2024-09-20 ⋅ McAfee ⋅ Aayush Tyagi, Yashvi Shah
Behind the CAPTCHA: A Clever Gateway of Malware
Emmenhtal Lumma Stealer
2024-09-09 ⋅ Denwp Research ⋅ Tonmoy Jitu
Dissecting Lumma Malware: Analyzing the Fake CAPTCHA and Obfuscation Techniques - Part 2
Lumma Stealer
2024-08-30 ⋅ Denwp Research ⋅ Tonmoy Jitu
Anatomy of a Lumma Stealer Attack via Fake CAPTCHA Pages - Part 1
Lumma Stealer
2024-08-22 ⋅ Mandiant ⋅ Aaron Lee, Praveeth DSouza
PEAKLIGHT: Decoding the Stealthy Memory-Only Malware
CryptBot Emmenhtal HijackLoader Lumma Stealer
2024-08-12 ⋅ Rapid7 ⋅ Tyler McGraw
Ongoing Social Engineering Campaign Refreshes Payloads
Black Basta Cobalt Strike GhostSocks Lumma Stealer SystemBC
2024-07-24 ⋅ Check Point Research ⋅ Antonis Terefos
Stargazers Ghost Network
Atlantida Lumma Stealer RedLine Stealer Rhadamanthys RisePro Stargazer Goblin
2024-07-23 ⋅ Fortinet ⋅ Fortinet
Exploiting CVE-2024-21412: A Stealer Campaign Unleashed
ACR Stealer Lumma Stealer Meduza Stealer
2024-07-22 ⋅ Censys ⋅ Censys, Embee_research
A Beginner’s Guide to Hunting Malicious Open Directories
Cobalt Strike Lumma Stealer Vidar
2024-07-11 ⋅ McAfee ⋅ Vignesh Dhatchanamoorthy, Yashvi Shah
ClickFix Deception: A Social Engineering Tactic to Deploy Malware
DarkGate Lumma Stealer
2024-07-02 ⋅ Sekoia ⋅ Quentin Bourgue
Exposing FakeBat loader: distribution methods and adversary infrastructure
BlackCat Royal Ransom EugenLoader Carbanak Cobalt Strike DICELOADER Gozi IcedID Lumma Stealer NetSupportManager RAT Pikabot RedLine Stealer SectopRAT Sliver SmokeLoader Vidar
2024-06-21 ⋅ 0x1c ⋅ 0x1c
[0001] AmberAmethystDaisy -> QuartzBegonia -> LummaStealer
Lumma Stealer
2024-06-17 ⋅ Trellix ⋅ Alejandro Houspanossian
Info Stealing Campaign Uses DLL Sideloading Through Legitimate Cisco Webex’s Binaries for Initial Execution and Defense Evasion
HijackLoader Lumma Stealer
2024-06-17 ⋅ Proofpoint ⋅ Proofpoint
From Clipboard to Compromise: A PowerShell Self-Pwn
DarkGate HijackLoader Lumma Stealer Matanbuchus NetSupportManager RAT TA571
2024-06-10 ⋅ Mandiant ⋅ Mandiant
UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion
Lumma Stealer MetaStealer Raccoon RedLine Stealer RisePro Vidar UNC5537
2024-06-06 ⋅ Morphisec ⋅ Arnold Osipov
Howling at the Inbox: Sticky Werewolf’s Latest Malicious Aviation Attacks
Angry Likho
2024-05-29 ⋅ eSentire ⋅ eSentire
Fake Browser Updates delivering BitRAT and Lumma Stealer
BitRAT Lumma Stealer
2024-03-24 ⋅ Viuleeenz ⋅ Alessandro Strino
Understanding API Hashing and build a rainbow table for LummaStealer
Lumma Stealer
2024-03-07 ⋅ Malware Traffic Analysis ⋅ Brad Duncan
2024-03-07 (THURSDAY): LATRODECTUS INFECTION LEADS TO LUMMA STEALER
Latrodectus Lumma Stealer
2024-02-13 ⋅ Palo Alto Networks Unit 42 ⋅ Ofir Ozer, Or Chechik
A Deep Dive Into Malicious Direct Syscall Detection
Lumma Stealer
2024-02-13 ⋅ Gridinsoft ⋅ Gridinsoft Cyber Security
What is Lumma Stealer?
Lumma Stealer
2024-02-04 ⋅ Viuleeenz ⋅ Alessandro Strino
Understanding PEB and LDR Structures using IDA and LummaStealer
Lumma Stealer
2024-01-30 ⋅ ANY.RUN ⋅ Lena (LambdaMamba)
CrackedCantil: A Malware Symphony Breakdown - PrivateLoader, Smoke, Lumma, RedLine, RisePro, Amadey, Stealc, Socks5Systemz, STOP
Amadey CrackedCantil Lumma Stealer PrivateLoader RedLine Stealer RisePro SmokeLoader Socks5Systemz Stealc STOP
2024-01-12 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update Q4 2023
FluBot Hook FAKEUPDATES AsyncRAT BianLian Cobalt Strike DCRat Havoc IcedID Lumma Stealer Meterpreter NjRAT Pikabot QakBot Quasar RAT RecordBreaker RedLine Stealer Remcos Rhadamanthys Sliver
2024-01-08 ⋅ YouTube (Embee Research) ⋅ Embee_research
Malware Analysis - Decoding Obfuscated Powershell and HTA Files (Lumma Stealer)
Lumma Stealer
2024-01-08 ⋅ Fortinet ⋅ Cara Lin
Deceptive Cracked Software Spreads Lumma Variant on YouTube
Lumma Stealer
2023-11-20 ⋅ Outpost24 ⋅ Alberto Marín
Unveiling LummaC2 stealer’s novel Anti-Sandbox technique: Leveraging trigonometry for human behavior detection
Lumma Stealer
2023-11-16 ⋅ Medium g0njxa ⋅ g0njxa
Approaching stealers devs : a brief interview with LummaC2
Lumma Stealer
2023-10-27 ⋅ Elastic ⋅ Joe Desimone, Salim Bitam
GHOSTPULSE haunts victims using defense evasion bag o' tricks
HijackLoader Lumma Stealer NetSupportManager RAT Rhadamanthys SectopRAT Vidar
2023-10-25 ⋅ Microsoft ⋅ Microsoft Incident Response, Microsoft Threat Intelligence
Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction
BlackCat BlackCat Lumma Stealer
2023-10-17 ⋅ Intrinsec ⋅ CTI Intrinsec
Lumma Stealer actively deployed in multiple campaigns
Lumma Stealer
2023-09-07 ⋅ eSentire ⋅ eSentire
The Case of LummaC2 v4.0
Lumma Stealer
2023-09-06 ⋅ Darktrace ⋅ DarkTrace
The Rise of the Lumma Info-Stealer
Lumma Stealer
2023-08-31 ⋅ Rapid7 Labs ⋅ Evan McCann, Natalie Zargarov, Thomas Elkins, Tyler McGraw
Fake Update Utilizes New IDAT Loader To Execute StealC and Lumma Infostealers
FAKEUPDATES Amadey HijackLoader Lumma Stealer SectopRAT
2023-04-09 ⋅ @0xToxin
LummaC2 BreakDown
Lumma Stealer
2023-04-05 ⋅ Outpost24 ⋅ Alberto Marín
Everything you need to know about the LummaC2 Stealer: Leveraging IDA Python and Unicorn to deobfuscate Windows API Hashing
Lumma Stealer
2023-02-27 ⋅ Medium s2wlab ⋅ Jiho Kim, Lee Sebin
Lumma Stealer targets YouTubers via Spear-phishing Email
Lumma Stealer
2023-02-03 ⋅ Cloudsek ⋅ Deepanjli Paulraj, Pavan Karthick M
Threat Actors Abuse AI-Generated Youtube Videos to Spread Stealer Malware
Alfonso Stealer Bandit Stealer Cameleon Fabookie Lumma Stealer Nanocore RAT Panda Stealer RecordBreaker RedLine Stealer Stealc STOP Vidar zgRAT
2023-01-13 ⋅ Twitter (@Ishusoka) ⋅ Ishu
Tweets on updates regarding Lumma Stealer
Lumma Stealer
2023-01-06 ⋅ cyble ⋅ Cyble
LummaC2 Stealer: A Potent Threat To Crypto Users
Lumma Stealer
2022-09-22 ⋅ Twitter (@sekoia_io) ⋅ sekoia
Tweets on Lumma stealer
Lumma Stealer
2022-08-16 ⋅ Twitter (@fumik0_) ⋅ fumik0
Tweet on Lumma Stealer based on Mars Stealer
Lumma Stealer
Credits: MISP Project