Insolent Werewolf
Insolent Werewolf is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets 6 sectors, including Government and Technology, in Russia. It uses 18 MITRE ATT&CK techniques.
- Insolent Hyena
- Techniques
- 18
- Exploited CVEs
- No CVE data
- First seen
- May 1, 2026
- Last seen
- Aug 1, 2026
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
18 techniques across 6 of 14 tacticsArsenal · Malware And Tools.
- CapDoormalware
- Excalibur Stealermalware
- NightStrikemalware
- NightWiremalware
- Octowave Loadermalware
- Adaptixtool
- AnyDesktool
- Cobalt Striketool
- Havoctool
- NetSupport Managertool
Indicators Of Compromise.
TLP:CLEAR72 indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout Insolent Werewolf.
Insolent Werewolf, previously tracked as Insolent Hyena, is assessed by the reporting vendor to be a cyber espionage cluster. It targets Russian organizations, primarily in the government sector and industrial and research organizations affiliated with the defense-industrial complex, and also science, education, retail and e-commerce, IT and engineering organizations. It was initially classified as a hacktivist group and was reclassified as an espionage actor because no evidence of destructive operations and no public claims were observed, its toolset is dominated by remote access tools and its targeting is strategic.
The cluster gains initial access through targeted phishing, including ClickFix pages that trick users into running PowerShell commands, and in some cases through access obtained from other espionage clusters. Dated observations run from May 2026 through August 2026 and are reported at month-level precision; the vendor's first analysis covered the cluster's activity from January through July 2026. The cluster installs MSI packages that drop legitimate applications together with malicious DLLs, which side-load Octowave Loader to decrypt and run its payloads.
Last updated Nov 2, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.