Arcane Werewolf Hacker Group Expands Arsenal with Loki 2.1 Malware Toolkit
The cyber espionage group Arcane Werewolf, also known as Mythic Likho, has enhanced its offensive capabilities by targeting Russian manufacturing enterprises with a new version of its custom malware.
The cyber espionage group Arcane Werewolf, also known as Mythic Likho, has enhanced its offensive capabilities by targeting Russian manufacturing enterprises with a new version of its custom malware.
According to a report by BI.ZONE Threat Intelligence, campaigns observed in October and November 2025 indicate a transition from the Loki 2.0 loader to a more advanced Loki 2.1 variant, which employs updated delivery mechanisms to evade detection.
The attacks commenced with phishing emails disguised as official correspondence. These emails contained links leading victims to spoofed websites that closely resembled legitimate Russian manufacturing companies.
In the October campaign, victims were deceived into downloading ZIP archives containing malicious LNK files. Upon execution, these files initiated a PowerShell command to download a Go-based dropper masquerading as an image file.
This dropper served a dual purpose: it opened a harmless decoy PDF, such as "Outgoing notification No. 7784," to distract the user while silently executing the Loki 2.0 loader in the background.
This loader was designed to collect basic host information, encrypt it using AES, and exfiltrate it to a Command and Control (C2) server while awaiting further payloads.
By November 2025, the threat landscape evolved rapidly. BI.ZONE researchers identified a shift in the attack chain involving a new C++ dropper.
The attacks commenced with phishing emails disguised as official correspondence.
This executable employed low-level system calls like NtCreateFile and ZwWriteFile to extract its payload. Significantly, this campaign marked the deployment of Loki 2.1.
Unlike previous versions, where the loader had to fetch the implant from a C2 server, the Loki 2.1 loader carried the updated implant embedded directly within its configuration.
The Loki 2.1 loader decrypts and executes the implant directly in the process memory, reducing network noise and dependence on external retrieval during the initial infection phase.
The dropper carries two Base64-encoded payloads:
chrome_proxy.pdf : a PE32+ executable (malicious loader). 09.2025.pdf : a PDF decoy.
The Loki 2.1 implant remains compatible with popular post-exploitation frameworks such as Mythic and Havoc but introduces distinct architectural changes.
The primary technical difference is in command identification; while Loki 2.0 mapped commands to djb2 hash values, Loki 2.1 uses a streamlined ordinal number system (0–11).
Arcane Werewolf's toolkit allows attackers to:
Manage Files: Upload and download data between the host and C2 server. Execute Code: Run processes via CreateProcessW or inject code (DLLs and shellcode) into target processes. Advanced Operations: Execute Beacon Object Files (BOF), manipulate Windows access tokens, and terminate specific processes. Persist and Evade: Change sleep intervals to mask traffic and clean up operations via an exit command.
Arcane Werewolf's ongoing reliance on brand impersonation remains a critical threat factor. By leveraging domain names that closely resemble those of major industry players and regulators, they exploit the trust inherent in the manufacturing sector.
Organizations are advised to scrutinize incoming correspondence for subtle domain irregularities as the group continues to refine its technical tradecraft.
Based on reporting by GBHackers.