Angry Likho APT Resurfaces with Lumma Stealer Attacks Against Russia

Angry Likho APT (aka Sticky Werewolf) has resurfaced with targeted spear-phishing campaigns against Russian and Belarusian government agencies and contractors, using malicious RAR attachments and a self-extracting installer (FrameworkSurvivor.exe) that launches Helping.cmd and an AutoIt loader to deploy the Lumma stealer; researchers observed image-based Base64 payloads, expanded command servers, and over 60 malicious implants.