[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPT6k_CuYj6fTb4mfz7UIc8e9rw1qRrNduM7yGr-E7Ws":3,"$fP-ngWv-vYHHW7CKj8cv5rb5jV6TfodeAPXpVdLKWrIk":51},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":48,"created_at":49,"updated_at":50,"published_at":24},"kaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz","Kaspersky Unveils Armored Likho APT Using BusySnake Stealer Against Russian, Brazilian, and Kazakh Government and Critical Infrastructure","Spear-phishing campaign deploys a Python-based infostealer to harvest credentials, cookies, and documents from government agencies and electrical power entities across three countries.","Kaspersky has identified a new APT group, Armored Likho, running a multi-stage spear-phishing campaign that drops a previously undocumented Python infostealer called BusySnake Stealer to steal credentials, browser data, and documents from government and critical infrastructure targets in Russia, Brazil, and Kazakhstan.",[10,11,12,13,14,15],"Armored Likho","BusySnake Stealer","Kaspersky","APT","spear-phishing","critical infrastructure","# Kaspersky Unveils Armored Likho APT Using BusySnake Stealer Against Russian, Brazilian, and Kazakh Government and Critical Infrastructure\n\n*Spear-phishing campaign deploys a Python-based infostealer to harvest credentials, cookies, and documents from government agencies and electrical power entities across three countries.*\n\n**Tags:** `Armored Likho` `BusySnake Stealer` `Kaspersky` `APT` `spear-phishing` `critical infrastructure`\n\n> Kaspersky has identified a new APT group, Armored Likho, running a multi-stage spear-phishing campaign that drops a previously undocumented Python infostealer called BusySnake Stealer to steal credentials, browser data, and documents from government and critical infrastructure targets in Russia, Brazil, and Kazakhstan.\n\n---\n\n## New APT 'Armored Likho' hits Russian, Brazilian, and Kazakh government and critical infrastructure\n\nKaspersky GReAT has identified a new APT group, which it is tracking as **Armored Likho** (also known as **Eagle Werewolf**), behind a multi-stage campaign targeting government agencies and electrical power entities in Russia, Brazil, and Kazakhstan.\n\nThe campaign combines financially motivated attacks against private individuals with cyber-espionage operations against organizations. The final-stage payload is a previously undocumented Python-based infostealer dubbed **BusySnake Stealer**, which Kaspersky says is capable of harvesting a broad range of sensitive data from compromised systems.\n\nVictims span major corporations, the public sector, IT, and education sectors. The group deploys tailored payloads per victim to maintain long-term interactive access and exfiltrate data, according to the vendor.\n\n## Spear-phishing entry and LLM-generated loaders\n\nInitial access is delivered through spear-phishing emails that masquerade as official government or social assistance documents. The payload arrives as a malicious ZIP attachment containing an executable, which the victim runs to start the multi-stage chain.\n\nKaspersky found that the first-stage loader components were generated with large language models, a detail it attributes to the redundant comments and code blocks visible in the loader source. The vendor notes this lets the group broaden its attack vectors and reduce detection, with the loaders relying on Python source code obfuscation and embedded network mechanisms to keep the initial foothold stealthy.\n\n## BusySnake Stealer: the primary infostealer\n\nBusySnake Stealer is the campaign’s primary infostealer, written in Python and deployed as the final-stage payload after the initial loader chain executes. It harvests browser credentials, cookies, saved documents, screen information, and reverse SSH tunnels from the compromised host, giving the attacker a broad data-exfiltration surface in a single implant.\n\nThe stealer uses a modular architecture with multiple malware versions, which Kaspersky says makes static analysis significantly harder than the group’s prior tools. The modular design lets the group swap or rotate components per victim, reducing the chance that a single static signature catches the full payload set.\n\nData exfiltration runs over Telegram Desktop\u002FAPI. The stealer combines the collected data into a single colon-delimited string, hashes it with SHA-256, and stores the result under a key called `sysmarker`. That same SHA-256 `sysmarker` hash is shared with AquilaRAT, the group’s other main implant, which ties the two tools together at the registration layer.\n\n## Full malware stack: AquilaRAT, Still Toolkit, and Go2Tunnel\n\nThe campaign deploys a five-component stack: **AquilaRAT** for remote access, **BusySnake Stealer** for infostealing, **Still Audio** for eavesdropping, **Still Sync** for data synchronization, and **Still Toolkit** as the dropper and GUI layer. Each component is tailored per victim, allowing the group to rotate payloads and maintain stealth across the full infection chain.\n\nGo2Tunnel handles reverse SSH tunneling, giving the attacker a persistent interactive shell back to the compromised host. The dropper uses the Tauri library to build its graphical interface, matching the architecture seen in the group’s February 2026 campaign. Kaspersky notes the Tauri-based GUI and the shared dropper structure as a key overlap between the two deployments.\n\nDetection is straightforward: Kaspersky flags the threat as `Trojan.Win64.Agent.*` and `HEUR:Backdoor.Win32.Generic`. The group obfuscates its Python source with PyArmor and decrypts payloads in memory using ChaCha20, keeping the implant chain lightweight and resistant to static analysis.\n\n## Attribution and infrastructure\n\nAttribution rests on code-level overlap with three prior Armored Likho campaigns: November 2024, February 2026, and July 2026. The current deployment shares an identical dropper architecture, including the Tauri GUI layer, with the February 2026 build. Kaspersky also flags the same Python source obfuscation and embedded network mechanisms across the loader chain, which is what ties the new BusySnake Stealer to the group’s earlier AquilaRAT and Go2Tunnel implants.\n\nInfrastructure follows the group’s usual pattern. C2 domains use a consistent naming scheme: `trustidcard[.]com`, `minicursor[.]com`, plus a set of `.com` and `.net` domains for the remaining C2 endpoints. The primary C2 IPs are `159[.]198[.]41[.]140` and `159[.]198[.]32[.]2`, with eight additional IPs rotating across the campaign. All infrastructure sits with the same hosting providers seen in the February and July 2026 deployments.\n\nThe group is not yet pinned to a specific nation, but the campaign profile — spear-phishing lures, Python-based implants, Telegram exfiltration, and the Tauri GUI — matches a state-backed APT. Kaspersky tracks the group as **Armored Likho**, also known as **Eagle Werewolf**.\n\n## Key points\n\n- Armored Likho delivers attacks via spear-phishing emails masquerading as government or social assistance documents, using malicious ZIP attachments and EXE payloads.\n- The final-stage payload is a Python-based infostealer dubbed BusySnake Stealer, capable of harvesting browser credentials, cookies, documents, and screen data from compromised systems.\n- Victims span government agencies and electrical power entities in Russia, Brazil, and Kazakhstan, with both financially motivated and cyber-espionage operations observed.\n- Kaspersky found LLM-generated first-stage loaders indicated by redundant comments and code blocks, showing the group is using AI to generate initial payloads.\n- The campaign uses tool polymorphism, Python source obfuscation, and embedded network mechanisms to bypass security solutions and maintain long-term interactive access.\n\n## Further reading & sources\n\n- [BusySnake Stealer Slithers Into Critical Infrastructure Networks](https:\u002F\u002Fwww.darkreading.com\u002Fcyberattacks-data-breaches\u002Fbusysnake-infostealer-critical-infrastructure-networks%250A)\n- [New Armored Likho tools target Telegram and eavesdropping | Securelist](https:\u002F\u002Fsecurelist.com\u002Farmored-likho-still-toolkit\u002F121033)\n- [Medium](https:\u002F\u002Fmedium.com\u002F@rst_cloud\u002Frst-ti-report-digest-06-jul-2026-b094bb1c520c)\n- [Medium](https:\u002F\u002Fmedium.com\u002F@rst_cloud\u002Frst-ti-report-digest-17-aug-2026-1ac59e1f7a17)\n- [RST TI Report Digest: 24 Aug 2026](https:\u002F\u002Fmedium.com\u002F@rst_cloud\u002Frst-ti-report-digest-24-aug-2026-5f4ab2af18b9)\n- [July 2026 Threat Trend Report on APT Groups - ASEC](https:\u002F\u002Fasec.ahnlab.com\u002Fen\u002F95040)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fkaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz.png?v=1bc6e1f6d4",{"actors":19,"malware":26,"timeline":36,"technologies":41},[20],{"url":21,"name":10,"slug":22,"type":23,"origin":24,"motivation":25},"\u002Fthreat-groups\u002Farmored-likho","armored-likho","unknown",null,"cyber-espionage and financially motivated attacks",[27,29,31,33,35],{"name":28},"Still Sync",{"name":30},"Still Audio",{"name":32},"AquilaRAT",{"name":34},"Still Toolkit",{"name":11},[37],{"date":38,"event":39,"description":40},"2026-07-06","Disclosure","Kaspersky discloses Armored Likho and BusySnake Stealer",[42,45,46],{"vendor":43,"product":44},"Telegram","Telegram Desktop \u002F API",{"vendor":12,"product":11},{"vendor":12,"product":47},"PyArmor Pro","threat_actor_activity","2026-09-19T12:06:09.947355+00:00","2026-10-16T12:28:24.852805+00:00",{"articles":52},[53,65,77,90],{"slug":54,"title":55,"summary":56,"tags":57,"hero_image_url":63,"story_type":48,"created_at":64},"google-apt42-deploys-nicecurl-and-tamecat-backdoors-via-journalist-spear-phishin","Google: APT42 Deploys Nicecurl and Tamecat Backdoors via Journalist Spear-Phishing","Google threat analysts report APT42 (Charming Kitten) is running spear-phishing campaigns that impersonate journalists and NGOs to deploy Nicecurl (VBScript) and Tamecat (PowerShell) backdoors for command execution and data exfiltration.",[58,59,60,61,14,62],"APT42","Charming Kitten","Nicecurl","Tamecat","IRGC-IO","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgoogle-apt42-deploys-nicecurl-and-tamecat-backdoors-via-journalist-spear-phishin.png?v=a73732edbd","2026-09-19T17:04:11.454764+00:00",{"slug":66,"title":67,"summary":68,"tags":69,"hero_image_url":75,"story_type":48,"created_at":76},"kaspersky-names-griffith-new-cyber-mercenary-set-hits-fintech-and-igaming-with-d","Kaspersky names Griffith: new cyber-mercenary set hits fintech and iGaming with DarkMe VB6 and C++ RAT","Kaspersky researchers identified a new intrusion set called Griffith, a cyber-mercenary campaign targeting fintech and iGaming that combines the established DarkMe VB6 malware with a new C++-based GriffithRAT implant, with samples clustered via threat intelligence.",[12,70,71,72,73,74],"Griffith","DarkMe","GriffithRAT","fintech","iGaming","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fkaspersky-names-griffith-new-cyber-mercenary-set-hits-fintech-and-igaming-with-d.png?v=49da33218a","2026-09-08T07:10:17.697992+00:00",{"slug":78,"title":79,"summary":80,"tags":81,"hero_image_url":88,"story_type":48,"created_at":89},"fortiguard-labs-flags-unc1549-for-spear-phishing-and-vdi-abuse-against-european-","FortiGuard Labs flags UNC1549 for spear-phishing and VDI abuse against European aerospace and telecom targets","FortiGuard Labs published an Outbreak Alert for UNC1549, a suspected Iran-linked espionage group targeting aerospace, defense, and telecom organizations in Europe with spear-phishing, credential theft, and VDI abuse for initial access and lateral movement.",[82,83,84,14,85,86,87],"UNC1549","FortiGuard Labs","Iran","VDI","CVE-2021-26855","CVE-2020-0688","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffortiguard-labs-flags-unc1549-for-spear-phishing-and-vdi-abuse-against-european-.png?v=31f9fd4fc4","2026-08-31T07:09:49.726163+00:00",{"slug":91,"title":92,"summary":93,"tags":94,"hero_image_url":100,"story_type":48,"created_at":101},"honeymyte-adds-kernel-mode-rootkit-to-coolclient-backdoor","HoneyMyte adds kernel-mode rootkit to CoolClient backdoor","HoneyMyte (Mustang Panda) APT has upgraded its CoolClient backdoor with a new Windows kernel-mode rootkit, Msagent.sys, that provides process hiding, file hiding, registry hiding, and network data filtering for deeper persistence and stealth in targeted intrusions across Asia and Russia.",[95,96,97,98,99,13],"HoneyMyte","Mustang Panda","CoolClient","Msagent.sys","Windows kernel rootkit","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhoneymyte-adds-kernel-mode-rootkit-to-coolclient-backdoor.png?v=81f9bb1ed5","2026-08-29T12:13:55.8896+00:00"]