Widely attributedUnknownLibrarian Likho
Russian-nexus APT targeting Russian government and IT organisations, using spearphishing and legitimate cloud services including Telegram and Dropbox for C2.
Attribution signal
?Score = mentions × confidence weight, summed across all attributed sources. Higher source diversity increases the score.≥ 10 High≥ 3 Moderate< 3 Low0.1
Low signal strength
Mentions1
Sources1
High conf.0
Last seenMay 2026
First observed
—
Last active
—
Origin
Russia
Aliases
1
Techniques
0
Campaigns
0
Russia
TargetsGovernmentTechnology
RegionsRussia
Attribution signals
1 mention · 1 source#1unspecified
TTP match
solar4rays
May 2026