Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
26 IOCs
Armored Likho expands its cyber-espionage toolkit
Excerpt
In May 2026, we discovered a new cyber-espionage campaign by the Armored Likho group, also known as Eagle Werewolf, that targets private individuals and organizations across various industries in Russia, including major corporations, the public sector, IT, and education. The attackers used a fake app as bait that mimics a service for donations. However, the most interesting part of this campaign isn’t the initial infection method – it’s the malicious implants the…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →26 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | 2ca8adbab98ebe305eacf272cf48f5a0 | Medium | Score 53/100 | First seen |
| Domain | orderapiserver.info | High | Score 58/100 | First seen |
| MD5 | 17674b250d8b422a50a86c9ff207186d | High | Score 56/100 | First seen |
| IP | 159.198.37.74 | High | Score 58/100 | First seen |
| IP | 145.223.69.143 | High | Score 58/100 | First seen |
| MD5 | c1d1ee16b92e6a138ffa048855f75d7d | High | Score 56/100 | First seen |
| Domain | service8date.com | High | Score 58/100 | First seen |
| IP | 145.223.68.66 | High | Score 58/100 | First seen |
| Domain | tg4service.com | High | Score 58/100 | First seen |
| IP | 187.127.153.38 | High | Score 58/100 | First seen |
| URL | https://srwinservice.com | High | Score 58/100 | First seen |
| MD5 | 62801f6223e860a7cca271522e303b2d | High | Score 86/100 | First seen |
| Domain | screenserv.com | High | Score 58/100 | First seen |
| Domain | managementapiservice.com | High | Score 58/100 | First seen |
| MD5 | d4bc09fb10ea2a5dc0bcbeeda5e5afdd | Medium | Score 53/100 | First seen |
| Domain | windowserv.net | High | Score 58/100 | First seen |
| Domain | updateservs.com | High | Score 58/100 | First seen |
| IP | 213.252.244.123 | High | Score 58/100 | First seen |
| IP | 23.27.24.30 | High | Score 58/100 | First seen |
| URL | https://tg4service.com:443 | High | Score 58/100 | First seen |
| MD5 | 68f0365d2fa8c828d012d8859e52a773 | Medium | Score 53/100 | First seen |
| MD5 | 3ac41b097236a7723821848ae31ef141 | Medium | Score 53/100 | First seen |
| IP | 23.26.237.250 | High | Score 58/100 | First seen |
| IP | 188.212.124.178 | High | Score 58/100 | First seen |
| MD5 | 4bd7c352ae277b0e38d07beedd4dd507 | Medium | Score 53/100 | First seen |
| MD5 | 439255736797bc88bd19f282449e0436 | High | Score 86/100 | First seen |
IOC Relationship Graph
Building graph…