THREAT OPS › Threat News › Armored Likho expands its cyber-espionage toolkit
Armored Likho expands its cyber-espionage toolkit
<p><img alt="" class="attachment-securelist-huge-promo size-securelist-huge-promo wp-post-image" height="400" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2026/08/12200329/SL-Armored-Likho-Still-Toolkit-featured-scaled-1-990x400.jpg" width="990" /></p><p>In May 2026, we discovered a new cyber-espionage campaign by the Armored Likho group, also known as Eagle Werewolf, tha
MITRE ATT&CK techniques
Indicators of compromise
- c1d1ee16b92e6a138ffa048855f75d7dmd5
- 17674b250d8b422a50a86c9ff207186dmd5
- 62801f6223e860a7cca271522e303b2dmd5
- 68f0365d2fa8c828d012d8859e52a773md5
- 4bd7c352ae277b0e38d07beedd4dd507md5
- d4bc09fb10ea2a5dc0bcbeeda5e5afddmd5
- 2ca8adbab98ebe305eacf272cf48f5a0md5
- 3ac41b097236a7723821848ae31ef141md5
- 439255736797bc88bd19f282449e0436md5
- https://bi.zone/eng/expertise/blog/triedinoe-zlo-oborotni-atakuyut-sotrudnikov-silovykh-struktur/url
- https://t.me/ptescalator/172url
- https://grpc.io/url
- https://tg4service.com:443url
- https://srwinservice.comurl
- https://www.kaspersky.com/enterprise-security/threat-intelligence-reporting?icid=gl_sl_tip-lnk_sm-team_c09760866e96002eurl
- https://opentip.kaspersky.com/c1d1ee16b92e6a138ffa048855f75d7d/?utm_source=sl&utm_medium=sl&utm_campaign=sl&icid=gl_sl_opentip-lnk_sm-team_03ffedaec03915bdurl
- https://opentip.kaspersky.com/17674b250d8b422a50a86c9ff207186d/?utm_source=sl&utm_medium=sl&utm_campaign=sl&icid=gl_sl_opentip-lnk_sm-team_ed7d752f6e761844url
- https://opentip.kaspersky.com/62801f6223e860a7cca271522e303b2d/?utm_source=sl&utm_medium=sl&utm_campaign=sl&icid=gl_sl_opentip-lnk_sm-team_bb57af0cb5c7a2e4url
- https://opentip.kaspersky.com/68f0365d2fa8c828d012d8859e52a773/?utm_source=sl&utm_medium=sl&utm_campaign=sl&icid=gl_sl_opentip-lnk_sm-team_0cd71d56fdb3369burl
- https://opentip.kaspersky.com/4bd7c352ae277b0e38d07beedd4dd507/?utm_source=sl&utm_medium=sl&utm_campaign=sl&icid=gl_sl_opentip-lnk_sm-team_d800368cfdc0b7b4url
- https://opentip.kaspersky.com/d4bc09fb10ea2a5dc0bcbeeda5e5afdd/?utm_source=sl&utm_medium=sl&utm_campaign=sl&icid=gl_sl_opentip-lnk_sm-team_d6de7d170dc66ec6url
- https://opentip.kaspersky.com/2ca8adbab98ebe305eacf272cf48f5a0/?utm_source=sl&utm_medium=sl&utm_campaign=sl&icid=gl_sl_opentip-lnk_sm-team_dbae37fb3dfd3231url
- https://opentip.kaspersky.com/3ac41b097236a7723821848ae31ef141/?utm_source=sl&utm_medium=sl&utm_campaign=sl&icid=gl_sl_opentip-lnk_sm-team_101775c48de453f9url
- https://opentip.kaspersky.com/439255736797bc88bd19f282449e0436/?utm_source=sl&utm_medium=sl&utm_campaign=sl&icid=gl_sl_opentip-lnk_sm-team_a69fc3960916ee99url
- https://opentip.kaspersky.com/orderapiserver.info/?utm_source=sl&utm_medium=sl&utm_campaign=sl&icid=gl_sl_opentip-lnk_sm-team_6ed980b3b8d4e8d5url
- https://opentip.kaspersky.com/tg4service.com/?utm_source=sl&utm_medium=sl&utm_campaign=sl&icid=gl_sl_opentip-lnk_sm-team_1c72634b15344ff7url
- https://opentip.kaspersky.com/srwinservice.com/?utm_source=sl&utm_medium=sl&utm_campaign=sl&icid=gl_sl_opentip-lnk_sm-team_180189023184fe03url
- https://opentip.kaspersky.com/screenserv.com/?utm_source=sl&utm_medium=sl&utm_campaign=sl&icid=gl_sl_opentip-lnk_sm-team_fe15038a10caebffurl
- https://opentip.kaspersky.com/windowserv.net/?utm_source=sl&utm_medium=sl&utm_campaign=sl&icid=gl_sl_opentip-lnk_sm-team_e7edd79e33a4094furl
- https://opentip.kaspersky.com/managementapiservice.com/?utm_source=sl&utm_medium=sl&utm_campaign=sl&icid=gl_sl_opentip-lnk_sm-team_5a82ce9511cba14curl
- https://opentip.kaspersky.com/service8date.com/?utm_source=sl&utm_medium=sl&utm_campaign=sl&icid=gl_sl_opentip-lnk_sm-team_541ee01f36cea116url
- https://opentip.kaspersky.com/updateservs.com/?utm_source=sl&utm_medium=sl&utm_campaign=sl&icid=gl_sl_opentip-lnk_sm-team_d11a326342b1cbd4url
- intelreports@kaspersky.comemail
- 187.127.153.38ipv4
- 159.198.37.74ipv4
- 213.252.244.123ipv4
- 23.26.237.250ipv4
- 23.27.24.30ipv4
- 188.212.124.178ipv4
- 145.223.69.143ipv4
Original source: https://securelist.com/armored-likho-still-toolkit/121033/