A newly discovered advanced persistent threat (APT) actor, tracked as Armored Likho, has been targeting government and electric power organizations in multiple countries, according to cybersecurity firm Kaspersky. The threat actor engages in both financially motivated attacks against individuals and cyber-espionage operations against organizations in Russia, Brazil, and Kazakhstan. This dual focus suggests a flexible and adaptable adversary capable of tailoring its methods to different victim profiles and objectives.
Armored Likho's arsenal includes modular remote access trojans (RATs) and information stealers, most notably the Python-based BusySnake Stealer, as well as tools like Go2Tunnel for remote access and network tunneling. This diverse malware stack enables the threat actor to maintain stealthy control of compromised hosts, exfiltrate credentials and other sensitive information, and dynamically deploy downloadable modules tailored to the victim's profile and the tasks at hand. The modular nature of the toolkit indicates that the group retains a high degree of operational flexibility and continues to invest in malware development.
Initial Access and Infection Chain
Armored Likho predominantly relies on spear-phishing to gain initial access to victim networks. The emails contain archives that hold executables or LNK files. Once the victim opens these files, they display decoy documents designed to distract the user while malware is silently installed in the background. This technique is common among espionage-focused APT groups because it exploits the natural tendency of users to focus on the decoy content rather than suspicious system activity.
In one observed infection chain, a loader injected in memory via an executable was seen fetching archives from public GitHub repositories. These repositories contained early development builds and test samples of the malware, likely used by the attackers to host their tools without relying on infractructure that could be easily taken down. The use of legitimate cloud services and code repositories to host malicious payloads is a growing trend among threat actors, as it complicates network defense and often bypasses allowlists.
Similarly, LNK files used in other campaigns display a fake document while a Python 3.12 interpreter and an archive are fetched in the background. This approach allows the malware to run using a legitimate interpreter, making it harder for security products to detect the malicious activity. The archive is then extracted and executed in memory or on disk, depending on the specific variant and the target environment.
BusySnake Stealer: A Powerful Tool
Among the components delivered by these archives is a Python-based infostealer that Kaspersky tracks as BusySnake Stealer. The malware packs multiple evasion techniques and dynamically decrypts bytecode only when a function is called, encrypting it immediately afterward. This means that static analysis tools and sandboxing systems may not see the full malicious functionality at once, as portions of the code only materialize in memory for brief moments during execution.
BusySnake Stealer runs in the background without a console window, further reducing its visibility. It relies on multiple handlers for various functions, including clipboard theft, file enumeration, extraction of 64-character hexadecimal keys, document exfiltration, screenshot capture, screenshot archiving, persistence checks, and command execution. These handlers are controlled via commands received from the command-and-control (C&C) server, allowing the attackers to switch between surveillance, data theft, and remote access as needed.
The stealer's capabilities extend far beyond typical credential theft. It can capture screenshots, exfiltrate logged keystroke data, and decrypt stored passwords from Chromium-based and Firefox browsers. It can also extract cookies from browsers, which lets the attackers hijack active sessions and bypass multi-factor authentication mechanisms that rely on session tokens. Additionally, the malware can scrape the machine for OTP keys, find cryptocurrency wallets, harvest Telegram sessions and credentials, and even restart RustDesk to capture users' credentials during remote support sessions.
A particularly notable feature is the ability to establish a reverse SSH tunnel, which effectively gives the attackers a persistent, encrypted channel back into the compromised network. Before BusySnake Stealer, Armored Likho relied on a separate tool called Go2Tunnel to achieve this functionality. The decision to integrate this into the infostealer suggests a streamlining of the malware stack, making the group more self-reliant and reducing the number of tools that need to be deployed.
Overlap with Eagle Werewolf
Kaspersky researchers note that Armored Likho's operations appear to overlap with activity attributed to another hacking group, known as Eagle Werewolf. Previously, Eagle Werewolf was observed using a RAT called AquilaRAT, which shares a similar structure and persistence mechanism with BusySnake Stealer. This overlap raises the possibility that the two groups are either the same organization or operate in close collaboration, sharing code and infrastructure.
Similarities in malware development and operational tactics often indicate a common author or the existence of shared toolkits sold or traded within the cybercriminal underground. However, espionage-focused APT groups rarely reuse tools unless there is a direct connection. The structural parallels between AquilaRAT and BusySnake Stealer suggest that Armored Likho may have evolved from earlier efforts, learning from past campaigns and refining its codebase.
Historical Context of Attacks on Government and Energy Sectors
The targeting of government and electric power entities is not a new phenomenon. For over a decade, APT groups have repeatedly probed these sectors for vulnerabilities, with notable incidents highlighting the potential consequences. The 2015 and 2016 attacks on the Ukrainian power grid, attributed to a group known as Sandworm, demonstrated how attackers can cause physical disruption by gaining remote access to industrial control systems. Similarly, the BlackEnergy malware used in those attacks began as a relatively simple tool but evolved to include modular plugins for destructive activities.
More recently, the COVID-19 pandemic saw a spike in attacks against healthcare and government agencies, as threat actors exploited the chaos and increased reliance on remote work. The energy sector, in particular, has become a frequent target due to its critical role in national infrastructure and the potential for cascading disruptions. Governments and private companies have responded by increasing investment in threat intelligence, network segmentation, and incident response capabilities, yet adversaries continue to adapt.
The discovery of Armored Likho underscores the ongoing threat to these sectors and the need for constant vigilance. While the group does not yet appear to have the destructive capabilities of groups like Sandworm, its espionage-focused toolkit is highly effective for gathering intelligence and maintaining long-term access. The dual nature of the group, combining financial motivation with cyber-espionage, makes it even more unpredictable and difficult to defend against.
Defensive Considerations and Recommendations
Organizations operating in the government and energy sectors should take note of the techniques employed by Armored Likho and assume that similar actors are actively targeting them. Spear-phishing remains the most common initial vector, so robust email security gateways and staff awareness training are essential. Users should be encouraged to verify unexpected attachments and links, especially those that prompt the opening of archive files.
On a technical level, organizations should implement application allowlisting to prevent unauthorized executables from running, as well as tight controls on PowerShell and Python interpreters if they are not strictly needed. The use of legitimate services like GitHub to host payloads highlights the importance of monitoring outbound network connections to cloud services, even those that are commonly allowed. Endpoint detection and response (EDR) solutions can help identify malicious behavior in memory, which is where BusySnake Stealer excels at hiding.
Network defenders should also pay attention to the persistence mechanisms used by such malware. In the case of BusySnake Stealer, the malware checks for persistence to ensure it survives reboots. Regularly reviewing scheduled tasks and startup registry keys, as well as monitoring for unusual outbound SSH connections, can help detect infections before they escalate.
Threat intelligence sharing among organizations within the same sector is another critical defense. Because APT actors often reuse infrastructure and techniques across multiple victims, timely sharing of indicators of compromise can enable others to block attacks early. Collaborating with industry groups, government agencies, and cybersecurity vendors like Kaspersky can provide the visibility needed to stay ahead of adversaries such as Armored Likho.
The continued evolution of this threat actor serves as a reminder that critical infrastructure operators must treat cyber threats as a persistent risk, not a one-time event. By understanding the tools, tactics, and procedures of groups like Armored Likho, defenders can better prepare themselves to detect and respond to future intrusions, reducing the likelihood of successful espionage or disruption. As the group continues to refine its malware and expand its operations, ongoing research and adaptation will be essential to safeguarding the systems that underpin modern society.
Source: SecurityWeek News