Arcane Werewolf Hacker Group Added Loki 2.1 Malware Toolkit to their Arsenal
The threat actor group known as Arcane Werewolf, also identified as Mythic Likho, has updated its attack capabilities by deploying a new version of its custom malware, Loki 2.1.
The threat actor group known as Arcane Werewolf, also identified as Mythic Likho, has updated its attack capabilities by deploying a new version of its custom malware, Loki 2.1.
During October and November 2025, this group was observed targeting Russian manufacturing companies. They continue to refine their tactics, indicating a sustained focus on the manufacturing sector and ongoing development of their malware toolkit.
The latest version of Loki now supports both the Mythic and Havoc post-exploitation frameworks, enhancing its flexibility and potential impact in the hands of skilled attackers.
The malware is distributed through carefully crafted phishing emails that appear to originate from legitimate manufacturing companies. Victims receive messages with links that lead to spoofed websites imitating real organizations. These links deliver ZIP archives hosted on the attackers' command and control servers.
During October and November 2025, this group was observed targeting Russian manufacturing companies.
Once the victim downloads and opens the archive, the infection chain commences. The attack begins when a malicious shortcut file, or LNK file, hidden inside the ZIP archive, is opened. This file triggers a command that uses PowerShell to download an executable disguised as an image file from the attacker's server.
The downloaded file is a dropper written in the Go programming language, which contains encoded payloads. The Go dropper decodes and executes two separate payloads sequentially. Initially, it drops a malicious loader called chrome_proxy.pdf, responsible for communication with the attacker's command and control server.
The malicious loader collects system information from the infected computer, including the computer name, operating system version, internal IP addresses, and username. This data is encrypted using the AES encryption algorithm and transmitted back to the attackers over HTTPS connections.
The loader then awaits commands from the attackers, capable of injecting malicious code into running processes, uploading files to the victim's system, or exfiltrating sensitive data. Additionally, the loader can terminate specific processes on the infected computer, granting attackers significant control over the system's operations, including the removal of security tools or other software that may interfere with their activities.
Based on reporting by Cyber Security News.