[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPT6k_CuYj6fTb4mfz7UIc8e9rw1qRrNduM7yGr-E7Ws":3,"$fP-ngWv-vYHHW7CKj8cv5rb5jV6TfodeAPXpVdLKWrIk":51},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":48,"created_at":49,"updated_at":50,"published_at":24},"kaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz","Kaspersky Unveils Armored Likho APT Using BusySnake Stealer Against Russian, Brazilian, and Kazakh Government and Critical Infrastructure","Spear-phishing campaign deploys a Python-based infostealer to harvest credentials, cookies, and documents from government agencies and electrical power entities across three countries.","Kaspersky has described a previously unknown APT group, Armored Likho, running a spear-phishing campaign that drops a previously undocumented Python infostealer called BusySnake Stealer against government agencies and the electric power sector in Russia, Brazil and Kazakhstan.",[10,11,12,13,14,15],"Armored Likho","BusySnake Stealer","Kaspersky","APT","spear-phishing","critical infrastructure","# Kaspersky Unveils Armored Likho APT Using BusySnake Stealer Against Russian, Brazilian, and Kazakh Government and Critical Infrastructure\n\n*Spear-phishing campaign deploys a Python-based infostealer to harvest credentials, cookies, and documents from government agencies and electrical power entities across three countries.*\n\n**Tags:** `Armored Likho` `BusySnake Stealer` `Kaspersky` `APT` `spear-phishing` `critical infrastructure`\n\n> Kaspersky has described a previously unknown APT group, Armored Likho, running a spear-phishing campaign that drops a previously undocumented Python infostealer called BusySnake Stealer against government agencies and the electric power sector in Russia, Brazil and Kazakhstan.\n\n---\n\n## A new APT and a new stealer\n\nOn 3 July 2026 Kaspersky published research on a previously unknown APT group it calls **Armored Likho**, which it links, on circumstantial evidence, to the group known as **Eagle Werewolf**. Kaspersky identified confirmed victims in Russia, Brazil and Kazakhstan, in government agencies and the electric power sector. It attributes the campaign to Armored Likho with medium confidence.\n\nThe final payload is **BusySnake Stealer**, a previously undocumented Python-based infostealer for Windows.\n\n## Spear-phishing entry and AI-generated loaders\n\nVictims receive spear-phishing emails carrying .zip or .rar archives with lures such as psychological tests and humanitarian aid applications. Kaspersky saw two delivery variants:\n\n- **EXE:** an NSIS self-extracting dropper that shows a decoy survey. The group's earlier droppers were written in Rust.\n- **LNK:** a shortcut that abuses ZDI-CAN-25373 to hide its command-line arguments and runs PowerShell to fetch a loader and a decoy DOCX.\n\nKaspersky says the first-stage payloads were generated using AI, pointing to verbose comments and bullet-point emojis in the loader code that are uncharacteristic of human-written malware.\n\n## What BusySnake Stealer does\n\nBusySnake's code is protected with PyArmor Pro and runs as a `.pyw` file to avoid a console window. According to Kaspersky, it can:\n\n- steal saved passwords and cookies from Chromium-based browsers and Firefox, including through a cookie module that installs a browser extension;\n- log the clipboard and harvest OTP\u002F2FA secrets;\n- inventory files and forward documents from Desktop, Documents and Downloads (up to 5 MB each);\n- take screenshots;\n- search for cryptocurrency wallet files;\n- steal Telegram Desktop session data (`tdata`) and RustDesk credentials;\n- start and stop a reverse SSH tunnel.\n\nIt talks to its command-and-control servers over HTTP(S). The original version persisted through a VBScript and a scheduled task named `WindowsHelper` that runs every five minutes. A newer version creates its scheduled task through the Schedule.Service COM object, pauses before running malicious routines to evade sandboxes, and can fetch and run arbitrary Python scripts from the C2 server in memory.\n\n## Links to earlier Armored Likho tools\n\nKaspersky ties BusySnake to two tools previously associated with the group. Its built-in reverse tunnelling uses the same SSH arguments and similar endpoints as the earlier standalone **Go2Tunnel** tool, and it shares a similar task-handler structure, C2 status-reporting endpoints and scheduled-task masquerade with **AquilaRAT** (which uses the task name `MicrosoftOfficeUpdate`).\n\n## A separate, later report: the Still Toolkit\n\nOn 13 August 2026 Kaspersky published a separate report on a different Armored Likho campaign, discovered in May 2026, which used a fake donation app to target private individuals and organisations in Russia. That campaign delivered the **Still Toolkit**, written in Rust: **Still Sync**, which steals Telegram session data and uses the Telegram API to pull chats and media, and **Still Audio**, which records audio covertly. Its dropper was built with the Tauri framework. Kaspersky links Still Audio to AquilaRAT through shared `sysmarker` host-fingerprinting logic and the same Blowfish key. These tools are not part of the BusySnake campaign described above.\n\n## Detection\n\nKaspersky's report lists indicators of compromise, including C2 domains, IP addresses and file hashes, and detection rules for its EDR products. Defenders should take IOCs directly from the [Securelist report](https:\u002F\u002Fsecurelist.com\u002Farmored-likho\u002F113588\u002F).\n\n## Key points\n\n- Kaspersky attributes a new spear-phishing campaign to Armored Likho (possibly Eagle Werewolf) with medium confidence.\n- Confirmed victims are government agencies and electric power organisations in Russia, Brazil and Kazakhstan.\n- First-stage loaders appear to be AI-generated; delivery uses NSIS droppers or LNK files abusing ZDI-CAN-25373.\n- BusySnake Stealer is a PyArmor-protected Python infostealer that takes browser credentials, cookies, documents, 2FA secrets, wallets and Telegram sessions, and opens reverse SSH tunnels.\n- The Still Toolkit, reported in August 2026, belongs to a separate Armored Likho campaign.\n\n## Further reading & sources\n\n- [Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign](https:\u002F\u002Fsecurelist.com\u002Farmored-likho\u002F113588\u002F) (Securelist, Kaspersky)\n- [New Armored Likho tools target Telegram and eavesdropping](https:\u002F\u002Fsecurelist.com\u002Farmored-likho-still-toolkit\u002F121033) (Securelist, Kaspersky)\n- [July 2026 Threat Trend Report on APT Groups](https:\u002F\u002Fasec.ahnlab.com\u002Fen\u002F95040) (AhnLab ASEC)\n- [BusySnake Stealer Slithers Into Critical Infrastructure Networks](https:\u002F\u002Fwww.darkreading.com\u002Fcyberattacks-data-breaches\u002Fbusysnake-infostealer-critical-infrastructure-networks) (Dark Reading)\n","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fkaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz.png?v=1bc6e1f6d4",{"actors":19,"malware":26,"timeline":36,"technologies":41},[20],{"url":21,"name":10,"slug":22,"type":23,"origin":24,"motivation":25},"\u002Fthreat-groups\u002Farmored-likho","armored-likho","unknown",null,"cyber-espionage and financially motivated attacks",[27,29,31,33,35],{"name":28},"Still Sync",{"name":30},"Still Audio",{"name":32},"AquilaRAT",{"name":34},"Still Toolkit",{"name":11},[37],{"date":38,"event":39,"description":40},"2026-07-06","Disclosure","Kaspersky discloses Armored Likho and BusySnake Stealer",[42,45,46],{"vendor":43,"product":44},"Telegram","Telegram Desktop \u002F API",{"vendor":12,"product":11},{"vendor":12,"product":47},"PyArmor Pro","threat_actor_activity","2026-09-19T12:06:09.947355+00:00","2026-10-16T12:28:24.852805+00:00",{"articles":52},[53,65,77,90],{"slug":54,"title":55,"summary":56,"tags":57,"hero_image_url":63,"story_type":48,"created_at":64},"honeymyte-adds-kernel-mode-rootkit-to-coolclient-backdoor","HoneyMyte adds kernel-mode rootkit to CoolClient backdoor","Kaspersky reports that HoneyMyte (Mustang Panda) has added a Windows kernel-mode rootkit, msagent.sys, to its CoolClient backdoor. The driver hides the backdoor's process, protects its files and registry entries and filters its C2 addresses from network data. Victims were found in Myanmar, Mongolia, Pakistan and Russia, including government entities.",[58,59,60,61,62,13],"HoneyMyte","Mustang Panda","CoolClient","Msagent.sys","Windows kernel rootkit","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhoneymyte-adds-kernel-mode-rootkit-to-coolclient-backdoor.png?v=81f9bb1ed5","2026-08-29T12:13:55.8896+00:00",{"slug":66,"title":67,"summary":68,"tags":69,"hero_image_url":74,"story_type":75,"created_at":76},"head-mare-apt-trojanizes-trueconf-client-installers-to-drop-phantomcore-and-phan","Head Mare APT trojanises TrueConf client installers to drop PhantomCore and PhantomGraph backdoors","Kaspersky reports that Head Mare compromised TrueConf video conferencing servers through two flaws that TrueConf fixed on 18 June 2026, then swapped the hosted client installer for a trojanised build delivering the PhantomCore and PhantomGraph backdoors. The campaigns target Russian organisations in six sectors.",[70,71,72,73,13],"Head Mare","TrueConf","PhantomCore","PhantomGraph","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhead-mare-apt-trojanizes-trueconf-client-installers-to-drop-phantomcore-and-phan.png?v=b570cfa52f","campaign","2026-08-28T17:23:49.323621+00:00",{"slug":78,"title":79,"summary":80,"tags":81,"hero_image_url":88,"story_type":48,"created_at":89},"star-blizzard-apt-swaps-clickfix-for-redflick-to-drop-cosmicpulse-on-ukrainian-t","Star Blizzard swaps ClickFix for RedFlick to deliver its CosmicPulse backdoor","Microsoft reports that Star Blizzard, a Russian state actor that CISA attributes to FSB Centre 18, has replaced its multi-step ClickFix chains with RedFlick, a delivery technique that needs a single user interaction and uses scheduled tasks to deploy the CosmicPulse backdoor. At least 13 campaigns since January 2026 affected more than 100 organisations, primarily in the United States and United Kingdom.",[82,83,84,85,86,87],"Star Blizzard","RedFlick","CosmicPulse","ClickFix","Ukraine","FSB","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstar-blizzard-apt-swaps-clickfix-for-redflick-to-drop-cosmicpulse-on-ukrainian-t.png?v=5367408196","2026-10-18T12:09:44.53734+00:00",{"slug":91,"title":92,"summary":93,"tags":94,"hero_image_url":101,"story_type":48,"created_at":102},"ahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-","AhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'","AhnLab ASEC, with Korea's National Intelligence Service, National Police Agency, KISA and the Financial Security Institute, published 'Operation Double Barrel' on 30 July 2026, describing a state-sponsored actor that has exploited Korean financial security software since 2025 and the overlaps it shares with Gunra ransomware intrusions.",[95,96,97,98,99,100],"Gunra","AhnLab ASEC","Operation Double Barrel","FortiOS","FortiProxy","Ransomware","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-.png?v=579bc98ad5","2026-09-18T07:15:06.272711+00:00"]