Sticky Werewolf
Sticky Werewolf is a threat actor group with an ideological motive, tracked by Brandefense. It targets the Government sector in Russia and Belarus. It uses 15 MITRE ATT&CK techniques.
- Angry Likho
- MimiStick
- PhaseShifters
- Techniques
- 15
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2023
- Record updated
Who They Target.
About Sticky Werewolf.
Angry Likho (referred to as Sticky Werewolf by some vendors) is an APT group we’ve been monitoring since 2023. It bears a strong resemblance to {{Awaken Likho}}, which we’ve analyzed before, so we classified it within the Likho malicious activity cluster. However, Angry Likho’s attacks tend to be targeted, with a more compact infrastructure, a limited range of implants, and a focus on employees of large organizations, including government agencies and their contractors. Given that the bait files are written in fluent Russian, we infer that the attackers are likely native Russian speakers. We’ve identified hundreds of victims of this attack in Russia, several in Belarus, and additional incidents in other countries. We believe that the attackers are primarily targeting organizations in Russia and Belarus, while the other victims were incidental, perhaps researchers using sandbox environments or exit nodes of Tor and VPN networks.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.