{
	"id": "620f1713-67d4-4361-b9bd-b5b121b1c134",
	"created_at": "2026-04-06T00:18:17.654306Z",
	"updated_at": "2026-04-10T03:35:36.880855Z",
	"deleted_at": null,
	"sha1_hash": "496a50c98efc5a47a06cd544441a3dace7261a06",
	"title": "Awaken Likho - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 45875,
	"plain_text": "Awaken Likho - Threat Group Cards: A Threat Actor\nEncyclopedia\nArchived: 2026-04-05 18:07:14 UTC\n APT group: Awaken Likho\nNames\nAwaken Likho (Kaspersky)\nCore Werewolf (BI.ZONE)\nCountry [Unknown]\nMotivation Information theft and espionage\nFirst seen 2021\nDescription\n(Kaspersky) In July 2021, a campaign was launched primarily targeting Russian government\nagencies and industrial enterprises. Shortly after the campaign started, we began tracking it,\nand published three reports in August and September 2024 through our threat research\nsubscription on the threat actor we named Awaken Likho (also named by other vendors as\nCore Werewolf).\nWhile investigating the activity of this APT group, we discovered a new campaign that began\nin June 2024 and continued at least until August. Analysis of the campaign revealed that the\nattackers had significantly changed the software they used in their attacks. The attackers now\nprefer using the agent for the legitimate MeshCentral platform instead of the UltraVNC\nmodule, which they had previously used to gain remote access to systems. The group remains\nfocused on targeting Russian government organizations and enterprises.\nObserved\nSectors: Government.\nCountries: Russia.\nTools used\nInformation\nLast change to this card: 24 October 2024\nDownload this actor card in PDF or JSON format\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=f3c3beeb-ae74-411b-8a9a-110533a0b28d\nPage 1 of 2\n\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=f3c3beeb-ae74-411b-8a9a-110533a0b28d\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=f3c3beeb-ae74-411b-8a9a-110533a0b28d\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=f3c3beeb-ae74-411b-8a9a-110533a0b28d"
	],
	"report_names": [
		"showcard.cgi?u=f3c3beeb-ae74-411b-8a9a-110533a0b28d"
	],
	"threat_actors": [
		{
			"id": "d18b9735-1af7-433c-a582-a01886bc5e3f",
			"created_at": "2024-10-25T02:02:07.582653Z",
			"updated_at": "2026-04-10T02:00:04.569471Z",
			"deleted_at": null,
			"main_name": "Awaken Likho",
			"aliases": [
				"Core Werewolf"
			],
			"source_name": "ETDA:Awaken Likho",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "90074ca4-8a4a-42dc-a395-25db4f44c1a4",
			"created_at": "2024-10-08T02:00:04.462582Z",
			"updated_at": "2026-04-10T02:00:03.722048Z",
			"deleted_at": null,
			"main_name": "Awaken Likho",
			"aliases": [
				"Core Werewolf"
			],
			"source_name": "MISPGALAXY:Awaken Likho",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434697,
	"ts_updated_at": 1775792136,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/496a50c98efc5a47a06cd544441a3dace7261a06.pdf",
		"text": "https://archive.orkl.eu/496a50c98efc5a47a06cd544441a3dace7261a06.txt",
		"img": "https://archive.orkl.eu/496a50c98efc5a47a06cd544441a3dace7261a06.jpg"
	}
}