A new APT and a new stealer
On 3 July 2026 Kaspersky published research on a previously unknown APT group it calls Armored Likho, which it links, on circumstantial evidence, to the group known as Eagle Werewolf. Kaspersky identified confirmed victims in Russia, Brazil and Kazakhstan, in government agencies and the electric power sector. It attributes the campaign to Armored Likho with medium confidence.
The final payload is BusySnake Stealer, a previously undocumented Python-based infostealer for Windows.
Spear-phishing entry and AI-generated loaders
Victims receive spear-phishing emails carrying .zip or .rar archives with lures such as psychological tests and humanitarian aid applications. Kaspersky saw two delivery variants:
- EXE: an NSIS self-extracting dropper that shows a decoy survey. The group's earlier droppers were written in Rust.
- LNK: a shortcut that abuses ZDI-CAN-25373 to hide its command-line arguments and runs PowerShell to fetch a loader and a decoy DOCX.
Kaspersky says the first-stage payloads were generated using AI, pointing to verbose comments and bullet-point emojis in the loader code that are uncharacteristic of human-written malware.
What BusySnake Stealer does
BusySnake's code is protected with PyArmor Pro and runs as a .pyw file to avoid a console window. According to Kaspersky, it can:
- steal saved passwords and cookies from Chromium-based browsers and Firefox, including through a cookie module that installs a browser extension;
- log the clipboard and harvest OTP/2FA secrets;
- inventory files and forward documents from Desktop, Documents and Downloads (up to 5 MB each);
- take screenshots;
- search for cryptocurrency wallet files;
- steal Telegram Desktop session data (
tdata) and RustDesk credentials; - start and stop a reverse SSH tunnel.
It talks to its command-and-control servers over HTTP(S). The original version persisted through a VBScript and a scheduled task named WindowsHelper that runs every five minutes. A newer version creates its scheduled task through the Schedule.Service COM object, pauses before running malicious routines to evade sandboxes, and can fetch and run arbitrary Python scripts from the C2 server in memory.
Links to earlier Armored Likho tools
Kaspersky ties BusySnake to two tools previously associated with the group. Its built-in reverse tunnelling uses the same SSH arguments and similar endpoints as the earlier standalone Go2Tunnel tool, and it shares a similar task-handler structure, C2 status-reporting endpoints and scheduled-task masquerade with AquilaRAT (which uses the task name MicrosoftOfficeUpdate).
A separate, later report: the Still Toolkit
On 13 August 2026 Kaspersky published a separate report on a different Armored Likho campaign, discovered in May 2026, which used a fake donation app to target private individuals and organisations in Russia. That campaign delivered the Still Toolkit, written in Rust: Still Sync, which steals Telegram session data and uses the Telegram API to pull chats and media, and Still Audio, which records audio covertly. Its dropper was built with the Tauri framework. Kaspersky links Still Audio to AquilaRAT through shared sysmarker host-fingerprinting logic and the same Blowfish key. These tools are not part of the BusySnake campaign described above.
Detection
Kaspersky's report lists indicators of compromise, including C2 domains, IP addresses and file hashes, and detection rules for its EDR products. Defenders should take IOCs directly from the Securelist report.
Key points
- Kaspersky attributes a new spear-phishing campaign to Armored Likho (possibly Eagle Werewolf) with medium confidence.
- Confirmed victims are government agencies and electric power organisations in Russia, Brazil and Kazakhstan.
- First-stage loaders appear to be AI-generated; delivery uses NSIS droppers or LNK files abusing ZDI-CAN-25373.
- BusySnake Stealer is a PyArmor-protected Python infostealer that takes browser credentials, cookies, documents, 2FA secrets, wallets and Telegram sessions, and opens reverse SSH tunnels.
- The Still Toolkit, reported in August 2026, belongs to a separate Armored Likho campaign.
Further reading & sources
- Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign (Securelist, Kaspersky)
- New Armored Likho tools target Telegram and eavesdropping (Securelist, Kaspersky)
- July 2026 Threat Trend Report on APT Groups (AhnLab ASEC)
- BusySnake Stealer Slithers Into Critical Infrastructure Networks (Dark Reading)