Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
19 IOCs
Arcane Werewolf revamps its arsenal with Loki 2.1 implant
Malware Families
Excerpt
The cluster targets Russian manufacturing companies In October and November 2025, BI.ZONE Threat Intelligence observed malicious activity by Arcane Werewolf (Mythic Likho) targeting Russian manufacturing enterprises. Retrospective analysis suggests that the threat actor most likely used phishing emails as the initial access vector, consistent with its previous campaigns. The messages were irrecoverable but presumably contained links to a malicious archive hosted on the…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →19 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | e90f7f8594333e0a955a1daccbf5e9030ea86fa3c5c39f58b69d313304020fdd | Medium | Score 53/100 | First seen |
| SHA256 | 6ccd834fdbba07cf071e3c6de703fbc7f9de10584df127ced27537db2e1a5a03 | Medium | Score 53/100 | First seen |
| SHA256 | 5f1d3992e426f47b572af12160f3cc7ac6c90634b17fd6a087eb1644a60a71f8 | Medium | Score 53/100 | First seen |
| SHA256 | f0cc251a2eb4a73aa20a8a90223600c9053a12ee94a1698ccbb9d189758ff4cb | Medium | Score 53/100 | First seen |
| URL | https://192.168.1.1/m2.png | High | Score 58/100 | First seen |
| SHA256 | fcd63239e4065414ba23d1546e18248653f6d937276520f16cf9a29308f65439 | Medium | Score 53/100 | First seen |
| SHA256 | 551c0455a608edd88ecd6946c93ed2ac9a68a48148630975a17905205629f617 | Medium | Score 53/100 | First seen |
| URL | https://cloud.electropriborzavod.ru/files/d8287185e4ae695a. | High | Score 58/100 | First seen |
| SHA256 | be317297dae16dd7b90ddd972b40aca810ff52f6a01a06c96d2dc4bbdd08231d | Medium | Score 53/100 | First seen |
| Domain | electropriborzavod.ru | High | Score 58/100 | First seen |
| URL | https://cdn.electropriborzavod.ru/index?data=encoded_base64_enc_data | High | Score 58/100 | First seen |
| SHA256 | 67751c565593ad4557e73a521b2da96431937296f9dba7d03839e9496031fcbb | Medium | Score 53/100 | First seen |
| SHA256 | 7fbb29f8724fddfb32b29543e046cf4aceab8f10e5120150f58d7a119162c631 | Medium | Score 53/100 | First seen |
| SHA256 | e45a1fca84ea0de58f88fe8930b0309f9d736b7384a12f01b7843a9f6469d64b | Medium | Score 53/100 | First seen |
| SHA256 | c0de8f8292721192cabe33ac51f2b26468bb2ca70f1e49cfb4647ff70bb14d23 | Medium | Score 53/100 | First seen |
| SHA256 | f73fe375cddea8a869edad7dd33b3783090113ff0dd0ab3b4e275006be40cadc | Medium | Score 53/100 | First seen |
| URL | https://cloud.electropriborzavod.ru/files/d8287185e4ae695a | High | Score 58/100 | First seen |
| SHA256 | 0f728de0881dc37e79d3e065a331b21f6acadb7d129db2a5bfc27551bba3892e | Medium | Score 53/100 | First seen |
| URL | https://cdn.electropriborzavod.ru/index?data=base64_enc_data | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…