Cybercrime

Armored Likho APT Targeting Government, Electric Power Entities

The threat actor uses modular RATs and information stealers in financially motivated and cyber espionage campaigns.

Ionut Arghire

Published

July 6, 2026

The threat actor uses modular RATs and information stealers in financially motivated and cyber espionage campaigns.

A recently discovered advanced persistent threat (APT) actor has been targeting government and electric power organizations in multiple countries, Kaspersky reports.

Dubbed Armored Likho, the APT engages both in financially motivated attacks against individuals and in cyber-espionage operations against organizations in Russia, Brazil, and Kazakhstan.

The threat actor’s arsenal includes modular remote access trojans (RATs) and information stealers, including the Python-based BusySnake Stealer, and tools like Go2Tunnel for remote access and network tunneling.

“This diverse malware stack enables the threat actor to maintain stealthy control of compromised hosts, exfiltrate credentials and other sensitive information, and dynamically deploy downloadable modules tailored to the victim’s profile and the tasks at hand,” Kaspersky notes.

Armored Likho mainly relies on spear-phishing for initial access. Archives attached to its emails contain executables or LNK files that, once opened, display decoys while malware is being installed in the background.

A loader injected in memory via such an executable was seen fetching archives from GitHub repositories that contain early development builds and test samples of the malware. The LNK files display a fake document while a Python 3.12 interpreter and an archive are fetched in the background.

Advertisement. Scroll to continue reading.

Among other components, the archives contain a Python-based infostealer that Kaspersky tracks as BusySnake Stealer. The malware packs multiple evasion techniques and dynamically decrypts bytecode when a function is called, encrypting it immediately after, and runs in the background without a console window.

The stealer relies on multiple handlers for various functions, such as clipboard theft, file enumeration, 64-character hexadecimal key extraction, document exfiltration, screenshot capture, screenshot archiving, persistence checks, and command execution.

Based on commands received from the command-and-control (C&C) server, the malware can capture screenshots, exfiltrate logged keystroke data, decrypt stored passwords from Chromium-based and Firefox browsers, extract cookies from browsers, scrape the machine for OTP keys, find cryptocurrency wallets, harvest Telegram sessions and credentials, establish a reverse SSH tunnel, and restart RustDesk to capture users’ credentials.

Before BusySnake Stealer, Armored Likho relied on Go2Tunnel to establish a reverse SSH tunnel, but has implemented the functionality into the infostealer, which can now provide the attackers with persistent remote access and interactive control over the victim’s system.

Armored Likho’s operations appear to overlap with Eagle Werewolf activity. Previously, the hacking group was seen using the AquilaRAT RAT, which shares a similar structure and persistence mechanism with BusySnake Stealer.