BI.ZONE
News
Insolent Werewolf revisited: hacktivism or espionage?

Insolent Werewolf revisited: hacktivism or espionage?

The cluster was believed to be driven primarily by hacktivism, but recent evidence points to espionage. We take a closer look at the adversaries’ motives and newly discovered tools

October 28, 2026

Insolent Werewolf was previously associated with ideologically motivated attacks intended to generate publicity. However, further monitoring revealed no typical signs of hacktivism: the threat actor had not used destructive malware, such as wipers or ransomware, or publicly claimed responsibility for its activities.

Insolent Werewolf is not interested in attracting widespread attention. Instead, it focuses on gaining and maintaining access to infrastructures, collecting data, and exploiting compromised IT environments. The cluster mainly targets government agencies, industrial enterprises, and R&D institutes associated with the defense industry. It uses spearphishing, including the ClickFix technique, and may also obtain access to victim systems from other cyber spies.

Oleg Skulkin

Head of BI.ZONE Threat Intelligence

The threat actor continues to refine its arsenal, selecting tools tailored to specific environments to impede detection by common security solutions. The NightStrike RAT was discovered in August 2026, but retrospective analysis revealed that it had been used since at least June. The malware enables remote control of compromised systems, collects data from browsers and applications, retrieves files, and captures screenshots.

Insolent Werewolf also used Octowave Loader to deliver AdaptixC2 and Havoc to target devices. Havoc had not previously been observed in the cluster’s operations. These findings build on our earlier report published in August, which noted that the adversaries might obtain access to victim infrastructures from other threat actors and use it in subsequent attacks.

Building an effective cybersecurity strategy requires an understanding of the methods and tools used by adversaries. Portals such as BI.ZONE Threat Intelligence provide up‑to‑date details on current threats, attackers, tactics, techniques, and tools.