New wave of targeted attacks of the Angry Likho APT on Russian organizations
Essential information
- Published
- 24/02/2025 09:02
- Modified
- 24/02/2025 09:39
- Tags
- 2025-02-24 apt autoit lumma trojan russia stealer targeted attacks
- Related entities
- 30 observables, 1 intrusion sets (apt), 13 techniques (mitre), 1 malware, 3 others
Description
The Angry Likho APT group has launched a new wave of targeted attacks primarily against Russian organizations. The group employs spear-phishing emails with malicious attachments as the initial attack vector. A previously unknown implant was discovered, utilizing a self-extracting archive and AutoIt scripts to deploy the Lumma Trojan stealer. The malware exfiltrates sensitive data, including browser information, cryptocurrency wallets, and authentication details. Hundreds of victims have been identified, mostly in Russia and Belarus. The group's tactics remain consistent, with periodic pauses in activity followed by new attack waves. They rely on readily available malicious utilities rather than developing custom tools.