CampaignPublished 18 May 2026

Spring harvest · Leek Likho group's campaign to hunt for documents

Source AlienVault OTX General

Description

The Leek Likho group (also known as SkyCloak or Vortex Werewolf) was first described by researchers in 2025, when a series of targeted attacks on public sector organizations in Russia and Belarus became known. This campaign was called Operation SkyCloak. We observed the continuation of its activity during February-April 2026, and also discovered a new technique that attackers use to filter files.

Impact

The campaign targets sensitive documents from public sector organizations, potentially leading to data theft and exposure of confidential information. The use of advanced filtering techniques may increase the efficiency of data exfiltration. No direct evidence of exploitation in the wild or broader impact beyond targeted regions is reported.

Defensive guidance

No specific patches or fixes are available as this is a threat actor campaign rather than a software vulnerability. Organizations in affected sectors should monitor for indicators of compromise related to the Leek Likho group and employ detection strategies focused on the tactics and tools identified. Follow vendor and threat intelligence updates for any new mitigation guidance.

Summary

The Leek Likho group is a threat actor first described in 2025 for targeted attacks on public sector entities in Russia and Belarus under Operation SkyCloak. Their ongoing campaign in early 2026, dubbed Spring harvest, focuses on document theft using new file filtering methods. The group leverages communication platforms like Telegram and Dropbox and employs techniques including persistence (T1547), remote access (T1090), and command execution (T1059). No known exploits in the wild or affected software versions are specified.

Indicators of compromise

Hashes 120

6615ea2fa3b879d27687a7ce917e93b0
37e83a8fc0e4e6ea5dab38b0b20f953b
6eafae19d2db29f70fa24a95cf71a19d
3e3c5471c69e933fcffa4f497ca936b8
44652be9dc36c33ef0a35d4422523f7c
8dbeb747aab3d3814bcee52c3b0f6ee5
2282e2158b7fb714f77d8b0974d980b87884933fSHA1 of 3e3c5471c69e933fcffa4f497ca936b8
675ce37d4549fb9e2fabee91befa53c0bac157e0SHA1 of 44652be9dc36c33ef0a35d4422523f7c
fc3b95b64aa817262e1dbb2fbfe6983e70a5f340SHA1 of 8dbeb747aab3d3814bcee52c3b0f6ee5
1280cca4b520bfd018296c4d1645b7c9c8c7c4608752506285dad0e251b22e32SHA256 of f4d05a5cb783f1cdd179795125d23139

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 18 May 2026, 20:06 UTC

MITRE ATT&CK techniques3 from threat tags

Technical details

Indicators of compromise

Hashes 120

Community reviews

Related threats