In October and November 2025, BI.ZONE Threat Intelligence observed malicious activity by Arcane Werewolf (Mythic Likho) targeting Russian manufacturing enterprises. Retrospective analysis suggests that the threat actor most likely used phishing emails as the initial access vector, consistent with its previous campaigns. The messages were irrecoverable but presumably contained links to a malicious archive hosted on the attackers’ C2 server. The links directed victims to a spoofed website imitating a Russian manufacturing company.