Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
41 IOCs
Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign
Threat Actors
Malware Families
Excerpt
Introduction During our routine threat monitoring, we uncovered a new phishing campaign tied to a previously unknown APT group that we dubbed Armored Likho (also known as Eagle Werewolf based on circumstantial evidence). This targeted campaign focuses heavily on government agencies and the electric power sector. The geographical footprint of these attacks spans Russia, Brazil, and Kazakhstan, establishing the group as a global threat actor. Armored Likho blends financially…
Read the original report →Diamond Model
Adversary(3)
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →41 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | 80b7700053e115d65365ce7330383320 | Medium | Score 53/100 | First seen |
| URL | http://grked.online:8000/tunnel/create/?username=redacted | High | Score 58/100 | First seen |
| MD5 | a0ec7a8e61eff3f445a7455b3aef9fbb | Medium | Score 53/100 | First seen |
| MD5 | 90378881856abfa47d7745c0a3ef9dc8 | Medium | Score 53/100 | First seen |
| MD5 | fd2bdd8047addee6fde2f532de181bfd | Medium | Score 53/100 | First seen |
| URL | https://grked.online/tunnel/create/?username=redacted | High | Score 58/100 | First seen |
| MD5 | ddff82a115558584bbd7741d4ffb35b4 | Medium | Score 53/100 | First seen |
| MD5 | 5d5c3e483c5e544260ce98fc29fbf192 | Medium | Score 56/100 | First seen |
| MD5 | f2ab09d7e7a375a192508a5014aa2ee4 | Medium | Score 53/100 | First seen |
| MD5 | e2550cfad9dcc880bf04f6048f90868c | Medium | Score 53/100 | First seen |
| Domain | ndrt.ink | High | Score 64/100 | First seen |
| MD5 | 006887732ca4a4a46a97989cf4deeef6 | Medium | Score 53/100 | First seen |
| MD5 | 0041fd1b2358cd08dbcbc28ea8fc3d20 | Medium | Score 53/100 | First seen |
| MD5 | 8188b2f347b77d65d08cfb23808ac244 | Medium | Score 53/100 | First seen |
| MD5 | 78135f72ab148a0cc074f6b2dd51fff6 | Medium | Score 53/100 | First seen |
| MD5 | 894332174f536c2e1efeda05cba79f8b | Medium | Score 53/100 | First seen |
| Domain | onetoken.ink | High | Score 64/100 | First seen |
| Domain | arvax.xyz | High | Score 64/100 | First seen |
| Domain | lvl99.store | High | Score 64/100 | First seen |
| Domain | winupdate.live | High | Score 64/100 | First seen |
| Domain | myboard.chickenkiller.com | High | Score 64/100 | First seen |
| MD5 | f5c6434ee5f7578faa3bc1257e1c9226 | Medium | Score 56/100 | First seen |
| MD5 | 732c31acf971a81c7e51b2a3dae82020 | Medium | Score 53/100 | First seen |
| MD5 | 7141917cba2eee2b4d31107faccf3a39 | Medium | Score 56/100 | First seen |
| MD5 | 1dba3e505491a260a44c867902c3296e | Medium | Score 53/100 | First seen |
| MD5 | c7622a1effa27bbfee6d6e03d6474343 | Medium | Score 53/100 | First seen |
| MD5 | cf74ac018d158ea2c2cfa1b1d71d95bc | Medium | Score 53/100 | First seen |
| MD5 | 7db9c688c620e54e8c69b7e52a7579fb | Medium | Score 53/100 | First seen |
| Domain | winupdate.ink | High | Score 64/100 | First seen |
| MD5 | c019797a00fd56edb1f468ac0a598510 | Medium | Score 53/100 | First seen |
| MD5 | 6b45ddb39a6e86229348dcbba3857e7c | Medium | Score 53/100 | First seen |
| IP | 159.198.75.219 | High | Score 58/100 | First seen |
| MD5 | 1096268fa2b3d454c86cf851cb782319 | Medium | Score 53/100 | First seen |
| MD5 | 2dfa1d949872c1b2f04952dd3e5f5d8f | Medium | Score 53/100 | First seen |
| IP | 69.67.173.153 | High | Score 58/100 | First seen |
| IP | 159.198.32.222 | High | Score 58/100 | First seen |
| Domain | varenie.live | High | Score 64/100 | First seen |
| IP | 159.198.41.140 | High | Score 70/100 | First seen |
| Domain | myboard.twilightparadox.com | High | Score 58/100 | First seen |
| MD5 | 393b498f2114cabc0b29d5fcd9dc6723 | Medium | Score 53/100 | First seen |
| MD5 | 07213c419489c02791e8d67b91e404ef | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…