Angry Likho: Old beasts in a new forest

This report describes the Angry Likho APT’s targeted spear-phishing campaign (since 2023, with renewed activity through Jan 2025) that uses NSIS SFX archives, obfuscated AutoIt installers, and the Lumma stealer to exfiltrate browser credentials, crypto-wallets, and other sensitive data from primarily Russian and Belarusian government organisations and contractors; the report provides technical analysis, sample hashes, and numerous malicious domains and IOCs.