A previously unknown threat actor called Armored Likho is hitting government agencies and electric power companies across Russia, Brazil, and Kazakhstan. Kaspersky published a technical analysis today detailing the group’s toolkit.
Armored Likho blends two motivations. It runs financially motivated campaigns against individuals while also conducting targeted cyber espionage against organizations. Their arsenal includes obfuscated modular RATs and infostealers built to bypass dynamic analysis.
Kaspersky says the group may overlap with a threat cluster tracked by BI.ZONE as Eagle Werewolf, active since May 2023. That group targets government and defense organizations, especially those involved in UAV development.
The infection chain starts with spear-phishing emails using government notice lures. Victims get a RAR archive containing EXE binaries that pull additional payloads from GitHub. Some attacks use Windows LNK files exploiting CVE-2025-9491, a Windows shortcut vulnerability Microsoft patched in November 2025. Trend Micro found that flaw had been weaponized by a dozen groups since 2017.
The payload is BusySnake — a Python-based infostealer that steals browser cookies, credentials, clipboard data, screenshots, cryptocurrency wallet files, and Telegram session data. It can also deploy RustDesk for remote access and establish reverse SSH tunnels. Kaspersky noted the malware dynamically decrypts bytecode only when a function is called, then re-encrypts it immediately — making analysis difficult.
A newer version of BusySnake adds a task-management framework that tracks C2 commands with statuses like SCHEDULED, IN_PROGRESS, and FAILED. Kaspersky also found signs that first-stage payloads were likely AI-generated, given redundant comments and code blocks.
