Loading threat actor…
Sticky Werewolf is a pro-Ukrainian cyber-espionage threat group known for phishing-led intrusions against Russian organizations, particularly government institutions, research institutes, and industrial enterprises associated with the defense-industrial sector. Reporting also links the group to targeting in Belarus and Poland. Known aliases include Angry Likho, MimiStick, and PhaseShifters. The group commonly relies on spearphishing for initial access, using spoofed messages themed around Russian state bodies and official business processes. Observed lures have impersonated entities such as the Ministry of Industry and Trade, EMERCOM, the Ministry of Construction, and the FSB. Delivery chains have included malicious attachments as well as phishing links designed to appear legitimate while also collecting victim telemetry for profiling and filtering. Sticky Werewolf has been associated with remote-access and information-stealing malware including Ozone RAT, Darktrack RAT, Glory Stealer, and MetaStealer. Ozone RAT has been used as a modular remote-access trojan capable of persistence, reflective loading of its main module, remote command execution, file and process management, registry modification, keylogging, screen and webcam capture, microphone recording, password recovery, reverse-proxy functionality, payload download and execution, and self-deletion. Campaigns have also shown use of decoy documents and disguised executables to conceal malware installation from victims. The actor’s tradecraft demonstrates reconnaissance and defense-evasion elements in addition to initial compromise and post-exploitation. Use of victim telemetry collection through phishing infrastructure has enabled profiling of targets and exclusion of unwanted environments such as sandboxes or researchers. Persistence through startup mechanisms and protected or obfuscated malware components has also been observed. Overall, Sticky Werewolf is best characterized as a politically aligned espionage actor focused on collecting access and intelligence from Russian state, research, and defense-related organizations.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
30 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
5 malware families Mallory has associated with this actor across public reporting.
24 indicators attributed to this actor. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.