New APT 'Armored Likho' hits Russian, Brazilian, and Kazakh government and critical infrastructure
Kaspersky GReAT has identified a new APT group, which it is tracking as Armored Likho (also known as Eagle Werewolf), behind a multi-stage campaign targeting government agencies and electrical power entities in Russia, Brazil, and Kazakhstan.
The campaign combines financially motivated attacks against private individuals with cyber-espionage operations against organizations. The final-stage payload is a previously undocumented Python-based infostealer dubbed BusySnake Stealer, which Kaspersky says is capable of harvesting a broad range of sensitive data from compromised systems.
Victims span major corporations, the public sector, IT, and education sectors. The group deploys tailored payloads per victim to maintain long-term interactive access and exfiltrate data, according to the vendor.
Spear-phishing entry and LLM-generated loaders
Initial access is delivered through spear-phishing emails that masquerade as official government or social assistance documents. The payload arrives as a malicious ZIP attachment containing an executable, which the victim runs to start the multi-stage chain.
Kaspersky found that the first-stage loader components were generated with large language models, a detail it attributes to the redundant comments and code blocks visible in the loader source. The vendor notes this lets the group broaden its attack vectors and reduce detection, with the loaders relying on Python source code obfuscation and embedded network mechanisms to keep the initial foothold stealthy.
BusySnake Stealer: the primary infostealer
BusySnake Stealer is the campaign’s primary infostealer, written in Python and deployed as the final-stage payload after the initial loader chain executes. It harvests browser credentials, cookies, saved documents, screen information, and reverse SSH tunnels from the compromised host, giving the attacker a broad data-exfiltration surface in a single implant.
The stealer uses a modular architecture with multiple malware versions, which Kaspersky says makes static analysis significantly harder than the group’s prior tools. The modular design lets the group swap or rotate components per victim, reducing the chance that a single static signature catches the full payload set.
Data exfiltration runs over Telegram Desktop/API. The stealer combines the collected data into a single colon-delimited string, hashes it with SHA-256, and stores the result under a key called sysmarker. That same SHA-256 sysmarker hash is shared with AquilaRAT, the group’s other main implant, which ties the two tools together at the registration layer.
Full malware stack: AquilaRAT, Still Toolkit, and Go2Tunnel
The campaign deploys a five-component stack: AquilaRAT for remote access, BusySnake Stealer for infostealing, Still Audio for eavesdropping, Still Sync for data synchronization, and Still Toolkit as the dropper and GUI layer. Each component is tailored per victim, allowing the group to rotate payloads and maintain stealth across the full infection chain.
Go2Tunnel handles reverse SSH tunneling, giving the attacker a persistent interactive shell back to the compromised host. The dropper uses the Tauri library to build its graphical interface, matching the architecture seen in the group’s February 2026 campaign. Kaspersky notes the Tauri-based GUI and the shared dropper structure as a key overlap between the two deployments.
Detection is straightforward: Kaspersky flags the threat as Trojan.Win64.Agent.* and HEUR:Backdoor.Win32.Generic. The group obfuscates its Python source with PyArmor and decrypts payloads in memory using ChaCha20, keeping the implant chain lightweight and resistant to static analysis.
Attribution and infrastructure
Attribution rests on code-level overlap with three prior Armored Likho campaigns: November 2024, February 2026, and July 2026. The current deployment shares an identical dropper architecture, including the Tauri GUI layer, with the February 2026 build. Kaspersky also flags the same Python source obfuscation and embedded network mechanisms across the loader chain, which is what ties the new BusySnake Stealer to the group’s earlier AquilaRAT and Go2Tunnel implants.
Infrastructure follows the group’s usual pattern. C2 domains use a consistent naming scheme: trustidcard[.]com, minicursor[.]com, plus a set of .com and .net domains for the remaining C2 endpoints. The primary C2 IPs are 159[.]198[.]41[.]140 and 159[.]198[.]32[.]2, with eight additional IPs rotating across the campaign. All infrastructure sits with the same hosting providers seen in the February and July 2026 deployments.
The group is not yet pinned to a specific nation, but the campaign profile — spear-phishing lures, Python-based implants, Telegram exfiltration, and the Tauri GUI — matches a state-backed APT. Kaspersky tracks the group as Armored Likho, also known as Eagle Werewolf.
Key points
- Armored Likho delivers attacks via spear-phishing emails masquerading as government or social assistance documents, using malicious ZIP attachments and EXE payloads.
- The final-stage payload is a Python-based infostealer dubbed BusySnake Stealer, capable of harvesting browser credentials, cookies, documents, and screen data from compromised systems.
- Victims span government agencies and electrical power entities in Russia, Brazil, and Kazakhstan, with both financially motivated and cyber-espionage operations observed.
- Kaspersky found LLM-generated first-stage loaders indicated by redundant comments and code blocks, showing the group is using AI to generate initial payloads.
- The campaign uses tool polymorphism, Python source obfuscation, and embedded network mechanisms to bypass security solutions and maintain long-term interactive access.