Armored Likko APT Deploys BusySnake Stealer Against Government and Power Sector

A previously undocumented advanced persistent threat group dubbed Armored Likho has been conducting cyber-espionage and financially motivated intrusions against government agencies and electric power sector organizations in Russia, Brazil, and Kazakhstan. According to Kaspersky's technical analysis, the group blends opportunistic campaigns aimed at stealing funds from private individuals with targeted operations against organizations, leveraging a modular toolkit of obfuscated RATs and infostealers specifically engineered to evade dynamic analysis sandboxes.

The threat actor's arsenal includes BusySnake Stealer, a previously unreported Python-based information stealer targeting Windows systems, with at least one variant featuring a dedicated module for harvesting cookies from web browsers. To maintain persistent access and facilitate lateral movement, Armored Likho also deploys Go2Tunnel, a custom utility that establishes a reverse SSH tunnel to a command-and-control server using a hardcoded private key. Researchers at BI.ZONE have noted potential overlaps between Armored Likho and a cluster they track as Eagle Werewolf, which has been active since May 2023 and previously compromised drone-focused Telegram channels to distribute AquilaRAT via Rust droppers masquerading as Starlink activation checklists.

The attack chain typically begins with spear-phishing emails using lures themed around official government notices or social programs, delivering RAR archives containing EXE binaries that serve as droppers. These droppers retrieve additional payloads, including the BusySnake stealer, from a GitHub repository and create VBScript files to erase execution traces and launch the stealer through a scheduled task. Alternate infection chains weaponize Windows shortcut (LNK) files to exploit CVE-2025-9491 (ZDI), a now-patched flaw in how Windows handles such files, achieving remote code execution. The group has also been observed abusing compromised Telegram channels for malware distribution, underscoring the multi-vector nature of their operations. Defenders should validate exposure by running a breach lookup on staff emails likely targeted by spear-phishing, while IT teams can audit outbound network paths with a port scanner to identify rogue reverse SSH tunnels, and security analysts should review endpoint telemetry for anomalies consistent with cookie theft using a browser fingerprint test.