{
  "name": "Spring harvest - Leek Likho group's campaign to hunt for documents",
  "slug": "spring-harvest-leek-likho-groups-campaign-to-hunt-for-documents",
  "description": "The Leek Likho group (also known as SkyCloak or Vortex Werewolf) was first described by researchers in 2025, when a series of targeted attacks on public sector organizations in Russia and Belarus became known. This campaign was called Operation SkyCloak. We observed the continuation of its activity during February-April 2026, and also discovered a new technique that attackers use to filter files.",
  "published": "2026-05-18T17:45:29+00:00",
  "created_at": "2026-05-18T17:45:29+00:00",
  "modified_at": "2026-05-18T17:56:23+00:00",
  "created_at_opencti": "2026-05-18T17:45:29+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2026-05-18",
    "dropbox",
    "likho",
    "messenger app",
    "skycloak",
    "telegram"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "1ba396a8cd9af661e0a5ceb1107c787290cff3ab05b70a9c5154f4e040f716be"
      },
      {
        "id": "",
        "name": "76542efd8113416322268676c8c32fc900661fe17db68a1ac9c2bcdcd936a7a6"
      },
      {
        "id": "",
        "name": "42910bf2aa4ac9d62e2b32e6fadc42f11bd7215fee492ecf72cfd6238965d066"
      },
      {
        "id": "",
        "name": "f78d87ff967bbdebbc43c58c2b5376522d2bbc975c98727c75bf28e2eb23ffd0"
      },
      {
        "id": "",
        "name": "1fbdb99357ace6d6db830c63850a6e8a4ea3607776c4668feb135f3ff0d95151"
      },
      {
        "id": "",
        "name": "85fba8ba8377974392b9147a2adf2d2955e9dfbb8d9e0659c7f90487b1105ae7"
      },
      {
        "id": "",
        "name": "a43e2231b200b294b35dfb50fad446a0a7e42783c4f541981bc85a8930fb670a"
      },
      {
        "id": "",
        "name": "d38de5d71d04dcd70039b897c2edbc0981ba8940c249872f7c3a77b60abb3955"
      },
      {
        "id": "",
        "name": "0c6c020a92517dcd757939c4f907550dbff08f133311d74928f27cf4133db7e9"
      },
      {
        "id": "",
        "name": "de73c1b5597f091b5e42e5d5b4dc40a46ddee4682308f5bbe010a32ede57b111"
      },
      {
        "id": "",
        "name": "1280cca4b520bfd018296c4d1645b7c9c8c7c4608752506285dad0e251b22e32"
      },
      {
        "id": "",
        "name": "06845a04d2329ca39c8378cb83118f6ffd278805f5b229cb65c21c4ca989fd56"
      },
      {
        "id": "",
        "name": "44abef9297d6573674b27416435c891317cfb9de8753d075806d5777563e6cc2"
      },
      {
        "id": "",
        "name": "6efdf511512be5e256951813f2008ce2c4572d6ef191c69a62b7555aa33255ac"
      },
      {
        "id": "",
        "name": "bbcdb82918f0decb1d6e20c90e872175cf278006948c5995ffd88033f56a1b71"
      },
      {
        "id": "",
        "name": "ddaef2e9377ce89222c3eadfb5b3c90e9a99f3d2d0635bbf5e7d8681eae051c7"
      },
      {
        "id": "",
        "name": "1e6ffcefe2561cbaaae6ff7a21fd5f90098610fda4d39889a8f6d4a510c20c10"
      },
      {
        "id": "",
        "name": "8f9029a5d5351078fc2f0b5499557c0f969b337817947314e37b2c7407ae2300"
      },
      {
        "id": "",
        "name": "fc8a6cc400dd822b6f5fc40c85a547cf7f266169edddb84a90f4b3f25956318c"
      },
      {
        "id": "",
        "name": "111e42c31f8e4ae3764f339d7ad04b20bb21be5d97ede13aaa7c73e72cb7549d"
      },
      {
        "id": "",
        "name": "2727d521ef98815ba82b2c2cc504123db59e1e4df487e3d6253280d21d00020e"
      },
      {
        "id": "",
        "name": "b4195e7584ac97d9c444ee6292160c80f9c889e6cba27cc656506d3c5fcffd48"
      },
      {
        "id": "",
        "name": "d0b18d94c4abd7f0f3a3d07fd2172956f6ec9654b8cbf087954017dd92bd9e4f"
      },
      {
        "id": "",
        "name": "2a9b971c835e2ee5f190d068c602601fdaf718d8bfe085c2032d59a6f25ed082"
      },
      {
        "id": "",
        "name": "8339333e1a1a8babc3fd72542e8fda58d19dd096cf2463867ca0328348338570"
      },
      {
        "id": "",
        "name": "fe0d64d07ef03b2db6a7fa1ccbcc62c3f24f003d5f5726129ff22341321575b4"
      },
      {
        "id": "",
        "name": "0a78005858bef767b39cfbbeb543a80dfde46807ee75594de77d3ddfe119e8b5"
      },
      {
        "id": "",
        "name": "63297928883b0dc4e0735963dbcb2b2fa0c1e131af6d486f882070a6eb7e339a"
      },
      {
        "id": "",
        "name": "8f4836cca1850053e87a769a84baed3cdde060ad3fce26f101a20b37375835f1"
      },
      {
        "id": "",
        "name": "f5f9f66d0fbc1ab7ad0efe82e0aa29e1665047e945c7b821bb4189901c57ef13"
      },
      {
        "id": "",
        "name": "a2306445f6a9a9313ec3709c84bc3e932f75240fcaf2543bb1cdc3c362b64552"
      },
      {
        "id": "",
        "name": "a79b5162f9a49df3db4f001325938b9dc7bdc471b71108ed178350c89252e3a5"
      }
    ],
    "attack_patterns": [
      {
        "id": "926a888c-190c-4efb-ab6b-f9d7e6a0fc54",
        "name": "T1547"
      },
      {
        "id": "ca53b2fa-42a8-45ec-9682-0cf54bf280f3",
        "name": "T1090"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Government"
      }
    ]
  },
  "external_refs": [
    "https://otx.alienvault.com/pulse/6a0b6c5acfd23c54ac29ea40",
    "https://securelist.ru/tr/leek-likho-hunting-for-data-with-tor-and-llms/115601/"
  ]
}