Arcane Werewolf Hacker Group Added Loki 2.1 Malware Toolkit to their Arsenal

Arcane Werewolf (Mythic Likho) launched targeted phishing campaigns in Oct–Nov 2025 against Russian manufacturing firms using a new Loki 2.1 implant delivered via ZIP archives containing LNK shortcuts. The attack chain uses PowerShell to fetch a Go-language dropper that decodes and executes a loader (chrome_proxy.pdf) which collects system metadata, can inject code, terminate processes, exfiltrate AES-encrypted data over HTTPS, and integrates with Mythic and Havoc post-exploitation frameworks—demonstrating active, sophisticated targeting and ongoing malware development.