Armored Likho Targets Government and Energy Networks With BusySnake Stealer

Armored Likho, a previously undocumented APT group also linked by indirect indicators to Eagle Werewolf, has been running a spear-phishing campaign against government agencies and electric power organizations in Russia, Kazakhstan, and Brazil. The attackers deliver a newly identified Python-based infostealer, BusySnake Stealer, through archive attachments containing either NSIS-built executable droppers or malicious .lnk files, including samples that abuse ZDI-CAN-25373 to conceal command-line arguments. Researchers said the malware is heavily obfuscated with PyArmor and that some first-stage loaders appear to be AI-generated, complicating attribution while preserving the group’s broader tradecraft.

Once installed, BusySnake establishes persistence with VBScript and scheduled tasks, then steals browser passwords, cookies, clipboard contents, screenshots, documents, Telegram session data, OTP secrets, and cryptocurrency wallet files. The malware also supports reverse SSH tunneling and remote control, downloads Python runtimes and dependencies, and in newer variants fetches and executes Python payloads directly in memory while tracking task status through an updated C2 framework. Reported infrastructure includes 159.198.41[.]140 and grked[.]online, and researchers noted architectural overlap with AquilaRAT and functional similarities to Go2Tunnel, reinforcing the attribution to Armored Likho.