Armored Likho Deploys BusySnake Stealer Against Government and Power Targets

Armored Likho (also tracked as Eagle Werewolf) is running a spear-phishing campaign against government agencies and electrical power organizations in Russia, Brazil, and Kazakhstan, using lures themed as official notices, humanitarian aid requests, and social programs. Victims are enticed into opening malicious archives or .lnk files, including files that abuse ZDI-CAN-25373, which launch staged loaders, decoy documents, and PowerShell activity before downloading Python components from GitHub such as Python 3.12, get-pip.py, and the main payload module.pyw to install the BusySnake Stealer.

BusySnake is a Python-based, heavily obfuscated infostealer protected with PyArmor Pro 9.2.0 that steals browser credentials and cookies, screenshots, clipboard data, documents, Telegram session files, 2FA-related data, and cryptocurrency wallet information. Researchers said newer variants delay execution for anti-analysis, change persistence through scheduled tasks and Windows component interfaces, add a task-status command-and-control framework, and support in-memory execution of arbitrary Python scripts, while the broader toolset can also deploy RustDesk and use reverse SSH tunneling for remote access. Attribution to Armored Likho was made with medium confidence based on overlaps with earlier tools including Go2Tunnel and AquilaRAT, and some first-stage loaders showed signs of possible AI-assisted generation.