Awaken Likho

Executive Summary

Awaken Likho is a highly adaptive state‑aligned APT group focused on espionage against Russian and allied entities across critical infrastructure sectors. The threat actors employ a blend of phishing, zero‑click exploitation, and remote‑management tools such as MeshCentral to maintain persistent footholds. Their latest malware iterations leverage AutoIt scripts and random domain generation for C2, indicating ongoing development and operational capability.

Goals & Targeting

Awaken Likho’s strategic objective centers on gathering actionable intelligence from high‑value targets that control critical infrastructure and national security assets. By targeting governmental, defense, energy, telecoms, finance, and industrial sectors across a wide geographic footprint—including Russia, Ukraine, the United States, China, India, and the Middle East—the group seeks to acquire intellectual property, state secrets, and proprietary technologies. The campaign appears driven by strategic geopolitical objectives tied to Russian state interests, prioritizing organizations that can influence regional power dynamics or provide insight into adversary capabilities.

Key Capabilities

• Exploits web‑based remote management platform MeshCentral
• Deploys AutoIt scripts for installation and configuration
• Launches backdoors such as TokenBuoy via DLL delivery
• Uses malicious LNK files in spam emails to trigger PowerShell commands
• Extracts configuration data from embedded JSON within DLLs
• Generates random domains for backup Command & Control servers
• Zero‑click exploitation via shellcode (Task Scheduler vulnerability)
• Sandbox escape using Task Scheduler vulnerability
• Privilege escalation through undocumented RPC endpoint
• Hidden PowerShell execution that downloads and runs RomCom RAT
• Exploit of CVE-2018-0802 via malicious RTF template
• Execution of HTA files and extraction of VBShower backdoor
• Phishing emails with malicious attachments (RTF, Excel) for initial access
• Use of malicious JavaScript downloaders in spear‑phishing campaigns
• Remote access tool installation (AnyDesk, Remote Utilities)
• Process injection into explorer.exe by SmokeLoader stager
• Credential theft from browsers and email clients

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Awaken Likho typically launches campaigns from a single command‑and‑control hub that quickly expands through dynamically generated domains, allowing the group to persist even when individual nodes are taken down. The attacker frequently targets Russian governmental entities but has broadened its scope to include multinational corporations in sectors like finance and energy—mirroring the geopolitical focus of Russian state actors. Operations exhibit a high tempo: initial access via spear‑phishing or zero‑click mechanisms is followed by rapid lateral movement using remote‑administration tools (MeshCentral, AnyDesk). The group demonstrates consistent use of credential theft modules to harvest browser data and email credentials, often integrating the stolen information into future phishing vectors. Notable past operations include a December 2021 rollout targeting defense contractors via malicious LNK attachments and a 2023 campaign exploiting CVE‑2018‑0802 in RTF templates to release VBShower backdoors. Awaken Likho’s tactics reflect an evolving threat that balances stealth with aggressive data exfiltration, often employing fileless execution pathways such as PowerShell scripts executed from memory.

IOC Patterns

• Suspicious LNK file attachments in spam emails
• PowerShell commands that download DLLs
• DLL installation from unknown source
• Embedded JSON configuration files inside DLLs
• Random domain generation for C2 backup servers
• Usage of MeshCentral as remote control channel

Recommended Actions

• Implement advanced email filtering to detect and block malicious LNK, RTF, Excel, ZIP attachments used in phishing campaigns.
• Enforce application whitelisting and strict execution policies to prevent AutoIt scripts and unknown DLLs from running.
• Restrict outbound traffic on uncommon remote‑management ports and monitor for unexpected MeshCentral connections.
• Deploy endpoint detection that flags hidden PowerShell activity and process injection into explorer.exe. Monitor DNS logs for newly registered random domains and block recognized malicious C2 servers. Apply timely patches for Windows Vulnerabilities (Task Scheduler CVE‑2018‑0802, CVE‑2017‑0199, CVE‑2017‑11882) and enforce CVE vulnerability management. Deploy script signing enforcement to mitigate fileless PowerShell attacks.
• Use behavioral analytics to detect credential‑stealing modules targeting browsers and email clients.
• Maintain an up‑to‑date inventory of authorized remote administration tools (UltraVNC, AnyDesk, Remote Utilities) to identify unapproved installations.

Suggested Tags