Core Werewolf
Core Werewolf is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets 5 sectors, including Government and Manufacturing, in 6 countries, including Russia and Taiwan. It uses 21 MITRE ATT&CK techniques.
- Techniques
- 21
- Exploited CVEs
- No CVE data
- First seen
- Aug 1, 2021
- Last seen
- Sep 1, 2024
- Record updated
Who They Target.
About Core Werewolf.
In July 2021, a campaign was launched primarily targeting Russian government agencies and industrial enterprises. Shortly after the campaign started, we began tracking it, and published three reports in August and September 2024 through our threat research subscription on the threat actor we named Awaken Likho (also named by other vendors as Core Werewolf). While investigating the activity of this APT group, we discovered a new campaign that began in June 2024 and continued at least until August. Analysis of the campaign revealed that the attackers had significantly changed the software they used in their attacks. The attackers now prefer using the agent for the legitimate MeshCentral platform instead of the UltraVNC module, which they had previously used to gain remote access to systems. The group remains focused on targeting Russian government organizations and enterprises.
Last updated Sep 27, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.