Loading threat actor…
PseudoSticky is a threat actor active since at least November 2025 that has targeted Russian organizations while deliberately imitating the tactics of the pro-Ukrainian group Sticky Werewolf. The actor has been observed using commodity remote access malware including RemcosRAT and DarkTrack RAT. Reported activity indicates an emphasis on deception and false-flag tradecraft, with operational patterns designed to resemble another actor rather than establish a distinct tooling profile. There are also indications that the group may have used large language models to help develop parts of its attack chains, although that aspect is less firmly established than the observed malware use and targeting. Based on currently available high-confidence information, PseudoSticky is best characterized as a cluster conducting intrusions against Russian organizations through impersonative tradecraft and RAT deployment.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
3 malware families Mallory has associated with this actor across public reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.