Loading story…
Armored Likho (also tracked as Eagle Werewolf) is running a spear-phishing campaign against government agencies and electrical power organizations in Russia, Brazil, and Kazakhstan, using lures themed as official notices, humanitarian aid requests, and social programs. Victims are enticed into opening malicious archives or .lnk files, including files that abuse ZDI-CAN-25373, which launch staged loaders, decoy documents, and PowerShell activity before downloading Python components from GitHub such as Python 3.12, get-pip.py, and the main payload module.pyw to install the BusySnake Stealer.
BusySnake is a Python-based, heavily obfuscated infostealer protected with PyArmor Pro 9.2.0 that steals browser credentials and cookies, screenshots, clipboard data, documents, Telegram session files, 2FA-related data, and cryptocurrency wallet information. Researchers said newer variants delay execution for anti-analysis, change persistence through scheduled tasks and Windows component interfaces, add a task-status command-and-control framework, and support in-memory execution of arbitrary Python scripts, while the broader toolset can also deploy RustDesk and use reverse SSH tunneling for remote access. Attribution to Armored Likho was made with medium confidence based on overlaps with earlier tools including Go2Tunnel and AquilaRAT, and some first-stage loaders showed signs of possible AI-assisted generation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
On July 3, 2026, Kaspersky published a technical analysis describing an active spear-phishing campaign attributed with medium confidence to Armored Likho (Eagle Werewolf). The report said the campaign targeted government agencies and the electric energy sector in Russia, Kazakhstan, and Brazil and detailed delivery of the BusySnake Stealer.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Armored Likho, a previously undocumented APT group also linked by indirect indicators to **Eagle Werewolf**, has been running a spear-phishing campaign against government agencies and electric power organizations in **Russia, Kazakhstan, and Brazil**. The attackers deliver a newly identified Python-based infostealer, **BusySnake Stealer**, through archive attachments containing either NSIS-built executable droppers or malicious `.lnk` files, including samples that abuse `ZDI-CAN-25373` to conceal command-line arguments. Researchers said the malware is heavily obfuscated with **PyArmor** and that some first-stage loaders appear to be AI-generated, complicating attribution while preserving the group’s broader tradecraft. Once installed, BusySnake establishes persistence with **VBScript** and scheduled tasks, then steals browser passwords, cookies, clipboard contents, screenshots, documents, Telegram session data, OTP secrets, and cryptocurrency wallet files. The malware also supports reverse SSH tunneling and remote control, downloads Python runtimes and dependencies, and in newer variants fetches and executes Python payloads directly in memory while tracking task status through an updated C2 framework. Reported infrastructure includes `159.198.41[.]140` and `grked[.]online`, and researchers noted architectural overlap with **AquilaRAT** and functional similarities to **Go2Tunnel**, reinforcing the attribution to Armored Likho.
Jul 12, 2026
Researchers reported an active cyberespionage campaign dubbed **Operation HumanitarianBait** that uses Russian-language humanitarian aid request themes to lure victims into opening a malicious `.lnk` file packaged inside a `.rar` archive. The shortcut launches PowerShell to decode obfuscated content, opens a decoy humanitarian aid PDF to distract the user, and silently installs a fileless, PE-less Python implant from **GitHub Releases** into a fake `WindowsHelper` directory under `%APPDATA%`. The payload is protected with **PyArmor v9.2 Pro**, helping it evade scrutiny while blending into legitimate developer traffic. Once installed, the malware establishes persistence through VBScript launchers and a recurring Windows Scheduled Task, then conducts broad surveillance and theft. Reported capabilities include browser credential and cookie theft, keylogging, clipboard and screenshot capture, file theft, and **Telegram** session theft, with optional covert remote access through **RustDesk** or **AnyDesk**. Stolen data is exfiltrated to a live custom Flask-based command-and-control server at `159.198.41[.]140` on a Namecheap VPS, and researchers said the Russian-language lures suggest the operation is aimed at Russian-speaking individuals or organizations, including those tied to aid distribution, civil administration, or government functions.
Jun 29, 2026
Researchers detailed how **Snake Keylogger**—also tracked as **404 Keylogger**—continues to spread through multi-stage infection chains that begin with phishing documents or other loaders and end in credential theft, surveillance, and data exfiltration. One analyzed campaign used a malicious Microsoft Word file with VBA macros that dropped an `.inf` file into `%TEMP%` and abused `LaunchINFSectionW` from `Advpack.dll` to execute the next stage through legitimate Windows components. That chain then used built-in tools to reconstruct and launch a disguised DLL downloader, which attempted to fetch an additional payload from a remote command-and-control endpoint. Separate technical analyses describe Snake as a long-running **malware-as-a-service** operation with modular .NET payloads, in-memory decryption, steganographic extraction of components, and execution techniques including process injection and process hollowing. The malware is designed to steal browser, email, FTP, Discord, and Wi-Fi credentials; log keystrokes; capture screenshots and clipboard data; profile infected hosts; and evade analysis through anti-debugging checks and termination of security tools. Researchers also reported persistence through registry keys, startup items, or scheduled tasks, and exfiltration over channels including **Telegram**, **SMTP**, and **FTP**, while linking the family to variants such as **Matiex**, **Cheetah**, and **Nova**.
Jul 13, 2026