Mythic Likho

Executive Summary

Mythic Likho, also known as Arcane Werewolf or Storm‑0978, is a highly sophisticated threat actor targeting defense, manufacturing, financial services and other critical sectors worldwide. The group combines spear‑phishing, drive‑by exploitation of browser and WinRAR zero‑day vulnerabilities, and heavily obfuscated backdoor payloads to gain initial access and establish persistence. Their operations indicate both espionage motives—evident from targeted credential theft—and a clear financial‑gain component through ransomware or data exfiltration.

Goals & Targeting

Mythic Likho’s strategic objective appears to combine state‑level intelligence collection with opportunistic financial gain. By compromising defense and manufacturing firms, the actor can exfiltrate sensitive design data or operational procedures for geopolitical advantage while also harvesting credentials or leveraging ransomware for direct payouts. The group favors highly technical and well-resourced targets that operate in regulated industries—government agencies, utility operators, aerospace manufacturers—and selects victims wherever a sophisticated exploitation chain is feasible.

Key Capabilities

• Spearfishing emails with personalized lures
• Spear‑phishing attachments using malicious RAR files
• Drive‑by exploitation of browser vulnerability CVE-2018-6065 via Cloudflare-mimicking redirect
• Redirection chain with a fake Cloudflare page and JavaScript loader
• Hardcoded 64-bit shellcode embedded in web pages to download encrypted payloads
• Decryption and execution of the downloaded binary
• Deployment of backdoor implants such as SnipBot, RustyClaw, and Mythic agent
• WinRAR path traversal zero-day (CVE-2025-8088) via alternate data streams to hide backdoors
• Exploitation of Cisco Smart Install CVE-2018-0171 and WinRAR CVEs (CVE-2025-6218/8088) for initial access
• Execution of reverse shells from modified XPS Viewer executables
• DLL hijacking/injection into Windows Defender using DllPath manipulation
• Browser credential theft via MiniBrowse stealer
• Permanently maintaining persistence through firmware implants (Synful Knock) and SNMP tooling
• Distributing signed malicious binaries using SSL.com certificates to masquerade as legitimate code
• .NET executable payloads that download secondary components in memory

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Mythic Likho has executed a series of highly technical campaigns that exploit multiple zero‑day vulnerabilities, leverage sophisticated spear‑phishing lures, and deploy stealthy backdoors to high‑value targets in defense, finance and manufacturing. The actor’s operations exhibit consistent use of Chrome CVE‑2018‑6065 drive‑by exploitation combined with a Cloudflare‑style redirection chain, followed by the delivery of encrypted payloads that run via hardcoded shellcode. Concurrent campaigns have employed WinRAR path traversal zero‑day (CVE‑2025‑8088) to hide backdoors for the first time in 2024, affecting organizations across Europe and Canada. Operational tempo is measured in bursts—typically spanning weeks to months with periods of inactivity—and indicates a well‑resourced threat actor capable of adapting rapidly to new patches or defensive measures. Victim types range from government agencies to critical infrastructure operators; notable past operations include compromise attempts on Russian manufacturing firms, U.S. financial services institutions and European aerospace contractors. The actor’s persistence tactics extend beyond software exploits: firmware implants via Synful Knock enable long‑term footholds, and the use of DLL hijacking into system components such as Windows Defender provides stealthy lateral movement opportunities. These patterns suggest a strategic intent to maintain continuous access while conducting both espionage and monetization activities.

IOC Patterns

• Phishing emails with personalized lures
• Inverted software update or internal documents
• Redirection to a Cloudflare-mimicking site
• Malicious JavaScript files loaded from URLs
• Exploit of Chrome CVE-2018-6065
• Hardcoded 64-bit shellcode embedded in the page
• Decryption and execution of downloaded binary
• WinRAR path traversal CVE‑2025‑8088 via alternate data streams to hide backdoor
• Delivery of backdoors such as SnipBot, RustyClaw, Mythic agent
• CVE-2018-0171 vulnerability in Smart Install feature of Cisco IOS
• CVE-2025-6218 WinRAR vulnerability exploit used
• CVE-2025-8088 zero-day WinRAR vulnerability
• Spear‑phishing email with RAR attachment and fake ministry documents
• Malicious XPS Viewer executable containing embedded reverse shell shellcode
• Directory traversal exploit writing files outside the target directory
• DLL hijacking via manipulated DllPath to load malicious DLLs into Windows Defender
• Signed binaries using SSL.com certificates masquerading as legitimate code
• Reverse shell connection from victim to attacker C2 server

Recommended Actions

• Patch Chrome browser to mitigate CVE‑2018‑6065 before the next vulnerable release.
• Apply and maintain updates for WinRAR, prioritizing fixes for CVE-2025-8088 (path traversal) and CVE-2025-6218 zero-day vulnerabilities.
• Deploy advanced email filtering and spear-phishing detection to block malicious links or attachments from unknown senders.
• Enable web-filtering and sandbox analysis to detect drive-by exploitation attempts and remotely loaded JavaScript payloads.
• Monitor endpoints for atypical shellcode execution, unauthorized file writes and hidden files in archive extraction; avoid using alternate data streams when extracting archives.
• Harden Cisco IOS devices by disabling or patching Smart Install feature to mitigate CVE-2018-0171 attacks.
• Log and inspect DLL loading paths, especially for Windows Defender and other system binaries, to detect hijacking via DllPath manipulation.
• Monitor network traffic for reverse shell connections and command-and-control patterns such as inbound C2 requests over uncommon ports or protocols.
• Verify code signatures of executable files and track the use of legitimate certificates from SSL.com that may be abused by malware authors.
• Implement an ongoing threat-hunting program focused on identifying persistence via firmware implants and SNMP-based tools.

Suggested Tags