Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…

Spring harvest - Leek Likho group's campaign to hunt for documents

0
Medium
Published: Mon May 18 2026 (05/18/2026, 19:45:29 UTC)
Source: AlienVault OTX General

Description

The Leek Likho group (also known as SkyCloak or Vortex Werewolf) was first described by researchers in 2025, when a series of targeted attacks on public sector organizations in Russia and Belarus became known. This campaign was called Operation SkyCloak. We observed the continuation of its activity during February-April 2026, and also discovered a new technique that attackers use to filter files.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 05/18/2026, 20:06:37 UTC

Technical Analysis

The Leek Likho group is a threat actor first described in 2025 for targeted attacks on public sector entities in Russia and Belarus under Operation SkyCloak. Their ongoing campaign in early 2026, dubbed Spring harvest, focuses on document theft using new file filtering methods. The group leverages communication platforms like Telegram and Dropbox and employs techniques including persistence (T1547), remote access (T1090), and command execution (T1059). No known exploits in the wild or affected software versions are specified.

Potential Impact

The campaign targets sensitive documents from public sector organizations, potentially leading to data theft and exposure of confidential information. The use of advanced filtering techniques may increase the efficiency of data exfiltration. No direct evidence of exploitation in the wild or broader impact beyond targeted regions is reported.

Mitigation Recommendations

No specific patches or fixes are available as this is a threat actor campaign rather than a software vulnerability. Organizations in affected sectors should monitor for indicators of compromise related to the Leek Likho group and employ detection strategies focused on the tactics and tools identified. Follow vendor and threat intelligence updates for any new mitigation guidance.

Affected Countries

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Author
AlienVault
Tlp
white
References
["https://securelist.ru/tr/leek-likho-hunting-for-data-with-tor-and-llms/115601/"]
Adversary
null
Pulse Id
6a0b6c5acfd23c54ac29ea40
Threat Score
null

Indicators of Compromise

Hash

ValueDescriptionCopy
hash6615ea2fa3b879d27687a7ce917e93b0
hash37e83a8fc0e4e6ea5dab38b0b20f953b
hash6eafae19d2db29f70fa24a95cf71a19d
hash3e3c5471c69e933fcffa4f497ca936b8
hash44652be9dc36c33ef0a35d4422523f7c
hash8dbeb747aab3d3814bcee52c3b0f6ee5
hash2282e2158b7fb714f77d8b0974d980b87884933f
SHA1 of 3e3c5471c69e933fcffa4f497ca936b8
hash675ce37d4549fb9e2fabee91befa53c0bac157e0
SHA1 of 44652be9dc36c33ef0a35d4422523f7c
hashfc3b95b64aa817262e1dbb2fbfe6983e70a5f340
SHA1 of 8dbeb747aab3d3814bcee52c3b0f6ee5
hash1280cca4b520bfd018296c4d1645b7c9c8c7c4608752506285dad0e251b22e32
SHA256 of f4d05a5cb783f1cdd179795125d23139
hash1ba396a8cd9af661e0a5ceb1107c787290cff3ab05b70a9c5154f4e040f716be
SHA256 of ffefe836255e742abc3dc692d1dda3a4
hash2727d521ef98815ba82b2c2cc504123db59e1e4df487e3d6253280d21d00020e
SHA256 of 873480ab887de3a9cbbcccb982747637
hash2a9b971c835e2ee5f190d068c602601fdaf718d8bfe085c2032d59a6f25ed082
SHA256 of 0b6f7356919b9632c1158681ee0462f3
hash42910bf2aa4ac9d62e2b32e6fadc42f11bd7215fee492ecf72cfd6238965d066
SHA256 of 4d5074d6e0722ceec45a083fa8444164
hash44abef9297d6573674b27416435c891317cfb9de8753d075806d5777563e6cc2
SHA256 of f1bc5841f6d6be1820848a7718bf4cce
hash6efdf511512be5e256951813f2008ce2c4572d6ef191c69a62b7555aa33255ac
SHA256 of f2b470dc3fcd8a2fd7860851a81f3eb0
hash76542efd8113416322268676c8c32fc900661fe17db68a1ac9c2bcdcd936a7a6
SHA256 of 8dbeb747aab3d3814bcee52c3b0f6ee5
hash8339333e1a1a8babc3fd72542e8fda58d19dd096cf2463867ca0328348338570
SHA256 of 3e3c5471c69e933fcffa4f497ca936b8
hash85fba8ba8377974392b9147a2adf2d2955e9dfbb8d9e0659c7f90487b1105ae7
SHA256 of 99dc0dbaf5bd3918803391ec8d6d802c
hash8f4836cca1850053e87a769a84baed3cdde060ad3fce26f101a20b37375835f1
SHA256 of 44652be9dc36c33ef0a35d4422523f7c
hash8f9029a5d5351078fc2f0b5499557c0f969b337817947314e37b2c7407ae2300
SHA256 of ac60971512c77f845cc4ec47400368a6
hashb4195e7584ac97d9c444ee6292160c80f9c889e6cba27cc656506d3c5fcffd48
SHA256 of ab24e08da9e205ee3d3a5a2a05345cb9
hashde73c1b5597f091b5e42e5d5b4dc40a46ddee4682308f5bbe010a32ede57b111
SHA256 of 6a72ad3c06a29e12e668e8701daee00e
hashfc8a6cc400dd822b6f5fc40c85a547cf7f266169edddb84a90f4b3f25956318c
SHA256 of 57dbf8c275fa56b9a84e9c4b9a35399e
hash6616717dfb2a795113b47d862c5412e2
hash99732e49668e56527963742922277459
hash111e42c31f8e4ae3764f339d7ad04b20bb21be5d97ede13aaa7c73e72cb7549d
SHA256 of 99732e49668e56527963742922277459
hash0a78005858bef767b39cfbbeb543a80dfde46807ee75594de77d3ddfe119e8b5
SHA256 of 2156c270ffe8e4b23b67efed191b9737
hash0b6f7356919b9632c1158681ee0462f3
hash4d5074d6e0722ceec45a083fa8444164
hash57dbf8c275fa56b9a84e9c4b9a35399e
hash6a72ad3c06a29e12e668e8701daee00e
hash873480ab887de3a9cbbcccb982747637
hash99dc0dbaf5bd3918803391ec8d6d802c
hashab24e08da9e205ee3d3a5a2a05345cb9
hashac60971512c77f845cc4ec47400368a6
hashf1bc5841f6d6be1820848a7718bf4cce
hashf2b470dc3fcd8a2fd7860851a81f3eb0
hashf4d05a5cb783f1cdd179795125d23139
hashffefe836255e742abc3dc692d1dda3a4
hash29de6fff67bdd0d8fb8e68476ff1040fde48420a
SHA1 of ab24e08da9e205ee3d3a5a2a05345cb9
hash7490e916130a814b1e33c955f4a64ad23c08df5b
SHA1 of 873480ab887de3a9cbbcccb982747637
hash7b50320a005cf68e5c17d51a8fd8422ceef1611a
SHA1 of 0b6f7356919b9632c1158681ee0462f3
hash854fb7550238d9e4983319540afc4b76f4a74237
SHA1 of f4d05a5cb783f1cdd179795125d23139
hash85d1c4c90242c054b17060885de556dfa5fe4cf9
SHA1 of ac60971512c77f845cc4ec47400368a6
hash863c91ef48d1fed77d260376a464bf0686d8afc6
SHA1 of ffefe836255e742abc3dc692d1dda3a4
hashaaa3b6ca2753ae491b639631c236cae350bdb0f7
SHA1 of 57dbf8c275fa56b9a84e9c4b9a35399e
hashaba35de9e819396f89f34c03058ebe71a7f98b6b
SHA1 of 4d5074d6e0722ceec45a083fa8444164
hashb2de369415574ffeb3858ff6a6213aa8397a331f
SHA1 of 99dc0dbaf5bd3918803391ec8d6d802c
hashb708bb12f86b0eb55a7f49cec9510efbc6b3e262
SHA1 of f2b470dc3fcd8a2fd7860851a81f3eb0
hashc2a8dae7ab6ea92dcfecbe2ab6ac7efc289d6a18
SHA1 of 6a72ad3c06a29e12e668e8701daee00e
hashe7f20ba2f9c12f164fef37c618481564b4db3399
SHA1 of f1bc5841f6d6be1820848a7718bf4cce
hasha6d095dc0e01f97db7e74cb5bed402dc
hash940658590d938380b71fd5055635c02564a63ef1
SHA1 of a6d095dc0e01f97db7e74cb5bed402dc
hashc22150121a13713b395a155af5d55680dde56ac1
SHA1 of 6616717dfb2a795113b47d862c5412e2
hash1fbdb99357ace6d6db830c63850a6e8a4ea3607776c4668feb135f3ff0d95151
SHA256 of a6d095dc0e01f97db7e74cb5bed402dc
hash63297928883b0dc4e0735963dbcb2b2fa0c1e131af6d486f882070a6eb7e339a
SHA256 of 53ac08488544ad1fefd6363db44549cf
hasha79b5162f9a49df3db4f001325938b9dc7bdc471b71108ed178350c89252e3a5
SHA256 of 6616717dfb2a795113b47d862c5412e2
hashbbcdb82918f0decb1d6e20c90e872175cf278006948c5995ffd88033f56a1b71
SHA256 of 227b3fa386cad73f0f388d801060e2c8
hash6f49d5e80acdbef693263ef60399bb8b
hash4b94efa49fb59a43ac4a9fdf04c87ef6
hash3d27e65ae5cb7aba8c529c8010b2414f24e4122b
SHA1 of 4b94efa49fb59a43ac4a9fdf04c87ef6
hashd38de5d71d04dcd70039b897c2edbc0981ba8940c249872f7c3a77b60abb3955
SHA256 of 63426f624c930a756faf7ce3e7b4789f
hashfe0d64d07ef03b2db6a7fa1ccbcc62c3f24f003d5f5726129ff22341321575b4
SHA256 of 4b94efa49fb59a43ac4a9fdf04c87ef6
hash63426f624c930a756faf7ce3e7b4789f
hash227b3fa386cad73f0f388d801060e2c8
hashd0b18d94c4abd7f0f3a3d07fd2172956f6ec9654b8cbf087954017dd92bd9e4f
SHA256 of dea287ef5916eced7808ca3704ae67a6
hash1ec5607bd9c37d6aabc43066fcb87ca6
hash53ac08488544ad1fefd6363db44549cf
hashdea287ef5916eced7808ca3704ae67a6
hash055e0229236497b91216b89395351ae8c9eed8f0
SHA1 of dea287ef5916eced7808ca3704ae67a6
hash3dd268fb969eaeb5d9068e185a9e33d5e25073cd
SHA1 of 53ac08488544ad1fefd6363db44549cf
hash694feb5c1f2b605eb58b4218fdc3d056f5d19aad
SHA1 of 1ec5607bd9c37d6aabc43066fcb87ca6
hash8e49c3ee98fc722c77b3b37e3abafb3581369b6e
SHA1 of 99732e49668e56527963742922277459
hasha609cf9a7250e6fbfc4cd3fdf04ea64b5a535617
SHA1 of 63426f624c930a756faf7ce3e7b4789f
hasha2306445f6a9a9313ec3709c84bc3e932f75240fcaf2543bb1cdc3c362b64552
SHA256 of 1ec5607bd9c37d6aabc43066fcb87ca6
hash2156c270ffe8e4b23b67efed191b9737
hash975d8bdfec6b58ae9004d526fa9f852108026a9c
SHA1 of 2156c270ffe8e4b23b67efed191b9737
hashaaba9f60d81467c27c82f5c6d6cb6accd6890fc4
SHA1 of 227b3fa386cad73f0f388d801060e2c8
hash099e92221466c0d380f8fac942b65641
hash14167b8732f917d9b15df47de9a94125
hash1a66a083fe2ac0adae45475825f3bb26
hash220ad634230523a239ab67253af00366
hash27dde6318bb7b2ca4f1f5df97007fbb8
hash284a56c416681090b3965250db2052d7
hash2a290051c0e6fc27dab6d4212ed37641
hash3e610b98255e35f492835b8c81d829a9
hash53bb7a229647cd4de8e23c075d4ffc2a
hash5d72a10241aa04f7d19da448cba2cab9
hash7578d6578f17f3d2f532414cd7808396
hash82710b81e610f074fe97a4f76e7f0843
hash85a2bd811866efadf369d6c0c54fc5b4
hash8c0434571198367df2cd1344f2bdc0cb
hasha9cfe3f8ad5def658e774eb2f6f0792c
hashad14a515332eb058436a7bba84b6affc
hashb1549dc141bad1ef7419b819f2419514
hashb8095944013853d982c4c045372a97c1
hashb95b03094ac3b361585ecfa88e0c78ca
hashc26198c104844e44d77d3da5389c040d
hashcbbd3923adb5705a1ce61cdebb6a93b6
hashd57868d796f5ffac7a038f1392509625
hashd688fb9bb64e916ff0bd68160caa6139
hashd7e7f396a695cb23d0fda4dc716e47a6
hashe355f9f69019a1248f4959fea69fab5f
hashebc8b65e3e35f66147fa4cbb9051a192
hashef0b5a716fcaaa26553a16c0c725a1bf
hash76b45853917fe87b3dc82331d542d1a6ddde806c
SHA1 of 8c0434571198367df2cd1344f2bdc0cb
hash9001e990f70fcb3cb7432ab3729bc9262395a371
SHA1 of 6f49d5e80acdbef693263ef60399bb8b
hash95cc727a9bf07bff285060b3b68c4b3de828969c
SHA1 of d7e7f396a695cb23d0fda4dc716e47a6
hasha75a744a8106626c39f5682556a0e58c40ce7315
SHA1 of a9cfe3f8ad5def658e774eb2f6f0792c
hashae5f7d3e621a862bc156483ec8894d5d56b23d8f
SHA1 of b95b03094ac3b361585ecfa88e0c78ca
hashc6aeba8b8469176baaba41c3c1fc32543f656982
SHA1 of cbbd3923adb5705a1ce61cdebb6a93b6
hasheb73acce3e09b649b6d736e5bbcfeeb0a00a7490
SHA1 of 82710b81e610f074fe97a4f76e7f0843
hash06845a04d2329ca39c8378cb83118f6ffd278805f5b229cb65c21c4ca989fd56
SHA256 of 8c0434571198367df2cd1344f2bdc0cb
hash0c6c020a92517dcd757939c4f907550dbff08f133311d74928f27cf4133db7e9
SHA256 of b95b03094ac3b361585ecfa88e0c78ca
hash1e6ffcefe2561cbaaae6ff7a21fd5f90098610fda4d39889a8f6d4a510c20c10
SHA256 of d7e7f396a695cb23d0fda4dc716e47a6
hasha43e2231b200b294b35dfb50fad446a0a7e42783c4f541981bc85a8930fb670a
SHA256 of 6f49d5e80acdbef693263ef60399bb8b
hashddaef2e9377ce89222c3eadfb5b3c90e9a99f3d2d0635bbf5e7d8681eae051c7
SHA256 of a9cfe3f8ad5def658e774eb2f6f0792c
hashf5f9f66d0fbc1ab7ad0efe82e0aa29e1665047e945c7b821bb4189901c57ef13
SHA256 of cbbd3923adb5705a1ce61cdebb6a93b6
hashf78d87ff967bbdebbc43c58c2b5376522d2bbc975c98727c75bf28e2eb23ffd0
SHA256 of 82710b81e610f074fe97a4f76e7f0843

Threat ID: 6a0b6dc9ec166c07b0ece25b

Added to database: 5/18/2026, 7:51:37 PM

Last enriched: 5/18/2026, 8:06:37 PM

Last updated: 5/20/2026, 2:48:24 PM

Views: 135

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

External Links

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses