VortexWerewolf
VortexWerewolf is referenced in the provided content as an APT group attribution associated with post-takedown QakBot activity and tooling expansion. The content links VortexWerewolf to operations involving QakBot, including the tchk campaign series active after the FBI’s August 2023 Operation Duck Hunt disruption. In the described activity, QakBot was delivered via an MSI installer masquerading as Adobe Acrobat, which dropped a legitimate Microsoft-signed OfficeClickToRun.exe and a trojanized antimalware_provider64.dll to achieve DLL sideloading and decrypt an embedded QakBot configuration. The report describes a mature operation with an Atlassian Bamboo CI/CD build path, multi-layer encrypted configuration storage, and infrastructure consisting of Tier 2 command-and-control servers hosted via providers in Armenia/Russia, Bulgaria, and Moldova, fronted by more than 100 compromised residential proxy nodes across 13 countries. The activity was still ongoing as of March 2026 and had expanded delivery methods and lures, including military- and government-themed documents. The content also associates this activity with RClone-Stealer-Mega for data exfiltration and SkyCloak as an evasion toolkit. No additional aliases or subgroup names beyond "vortexwerewolf" are provided in the content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Associated malware families
1 malware family attributed to this actor across reporting.
Observables
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.