{
	"id": "bca70270-498f-4186-bd9c-b7fce8f0bd7d",
	"created_at": "2026-04-06T00:14:55.140154Z",
	"updated_at": "2026-04-10T13:11:19.000886Z",
	"deleted_at": null,
	"sha1_hash": "899df26aab56310193292f0e981772aabc9dfa37",
	"title": "Angry Likho - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 42456,
	"plain_text": "Angry Likho - Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 15:54:12 UTC\n APT group: Angry Likho\nNames Angry Likho (?)\nCountry [Unknown]\nMotivation Information theft and espionage\nFirst seen 2023\nDescription\n(Kaspersky) Angry Likho (referred to as Sticky Werewolf by some vendors) is an APT group\nwe’ve been monitoring since 2023. It bears a strong resemblance to Awaken Likho, which\nwe’ve analyzed before, so we classified it within the Likho malicious activity cluster.\nHowever, Angry Likho’s attacks tend to be targeted, with a more compact infrastructure, a\nlimited range of implants, and a focus on employees of large organizations, including\ngovernment agencies and their contractors. Given that the bait files are written in fluent\nRussian, we infer that the attackers are likely native Russian speakers.\nWe’ve identified hundreds of victims of this attack in Russia, several in Belarus, and additional\nincidents in other countries. We believe that the attackers are primarily targeting organizations\nin Russia and Belarus, while the other victims were incidental—perhaps researchers using\nsandbox environments or exit nodes of Tor and VPN networks.\nObserved\nSectors: Government.\nCountries: Belarus, Russia.\nTools used LummaC2.\nInformation Last change to this card: 02 March 2025\nDownload this actor card in PDF or JSON format\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=419130a6-acc7-48e1-9633-db31c6dda0db\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=419130a6-acc7-48e1-9633-db31c6dda0db\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=419130a6-acc7-48e1-9633-db31c6dda0db"
	],
	"report_names": [
		"showcard.cgi?u=419130a6-acc7-48e1-9633-db31c6dda0db"
	],
	"threat_actors": [
		{
			"id": "d18b9735-1af7-433c-a582-a01886bc5e3f",
			"created_at": "2024-10-25T02:02:07.582653Z",
			"updated_at": "2026-04-10T02:00:04.569471Z",
			"deleted_at": null,
			"main_name": "Awaken Likho",
			"aliases": [
				"Core Werewolf"
			],
			"source_name": "ETDA:Awaken Likho",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "c6d22751-e854-47de-a33d-2adf0058683e",
			"created_at": "2025-03-03T02:02:00.191696Z",
			"updated_at": "2026-04-10T02:00:04.534478Z",
			"deleted_at": null,
			"main_name": "Angry Likho",
			"aliases": [],
			"source_name": "ETDA:Angry Likho",
			"tools": [
				"Lumma Stealer",
				"LummaC2"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "ce6c9df9-bf82-4e6c-b355-9285463a37c8",
			"created_at": "2025-03-07T02:00:03.792481Z",
			"updated_at": "2026-04-10T02:00:03.818734Z",
			"deleted_at": null,
			"main_name": "Angry Likho",
			"aliases": [
				"Sticky Werewolf"
			],
			"source_name": "MISPGALAXY:Angry Likho",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "90074ca4-8a4a-42dc-a395-25db4f44c1a4",
			"created_at": "2024-10-08T02:00:04.462582Z",
			"updated_at": "2026-04-10T02:00:03.722048Z",
			"deleted_at": null,
			"main_name": "Awaken Likho",
			"aliases": [
				"Core Werewolf"
			],
			"source_name": "MISPGALAXY:Awaken Likho",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434495,
	"ts_updated_at": 1775826679,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/899df26aab56310193292f0e981772aabc9dfa37.pdf",
		"text": "https://archive.orkl.eu/899df26aab56310193292f0e981772aabc9dfa37.txt",
		"img": "https://archive.orkl.eu/899df26aab56310193292f0e981772aabc9dfa37.jpg"
	}
}