Armored Likho APT Deploys BusySnake Python Stealer with PyArmor Obfuscation Against Government and Power Infrastructure Targets
Armored Likho APT Deploys BusySnake Python Stealer with (TL-2026-1097), also tracked as BusySnake Stealer Campaign, is a high-severity malware campaign, first published 2026-07-03. It is attributed to Armored Likho with medium confidence, affects Microsoft Windows (.lnk shortcut handling, all supported versions), references 1 CVE (CVE-2025-9491), maps to 35 MITRE ATT&CK techniques (T1005, T1027, T1027.002), and is covered by 9 detection rules and 37 indicators of compromise.
Key facts for TL-2026-1097
- Threat ID
- TL-2026-1097
- Also known as
- BusySnake Stealer Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-03
- Last reviewed
- 2026-07-03
- Attribution
- Armored Likho
- Attribution confidence
- MEDIUM
- Motivation
- ESPIONAGE
- Target sectors
- government administration, energy, critical infrastructure
- Target regions
- russia, kazakhstan, brazil
- Detection rules
- 9
- Indicators of compromise
- 37
Malware and tooling in Armored Likho APT Deploys BusySnake Python Stealer with
Malware and tooling: AquilaRAT, BusySnake, Go2Tunnel, PyArmor Pro v9.2.0, REST task-execution C2 API, RustDesk
Kaspersky Securelist reports the Armored Likho (aka Eagle Werewolf) threat actor remains highly active, deploying a new Python-based infostealer dubbed BusySnake against government agencies and electrical power infrastructure using PyArmor Pro v9.2.0 obfuscation, NSIS self-extracting droppers, and ZDI-CAN-25373/CVE-2025-9491 LNK exploitation, with confirmed victims in Russia, Kazakhstan, and Brazil.
How Armored Likho APT Deploys BusySnake Python Stealer with works
Armored Likho (aka Eagle Werewolf), a cyberespionage cluster tracked by Kaspersky and previously documented by BI.ZONE, continues an active campaign against government agencies and electrical power infrastructure operators, with confirmed victims identified in Russia, Kazakhstan, and Brazil. The group's newest tool, a Python-based infostealer dubbed BusySnake, is protected with PyArmor Pro v9.2.0, which dynamically decrypts bytecode at function-call time and immediately re-encrypts it afterward, and ships as a .pyw file that runs without a visible console window.
Initial access is achieved via spear-phishing emails carrying self-extracting NSIS archives (e.g. disguised as a 'psychological test' - psihologicheskiy_test.exe) that display a decoy application while injecting code into a legitimate spawned process (pnx.exe) and fetching second-stage payloads from GitHub repositories, and via malicious .lnk shortcut files that abuse the ZDI-CAN-25373 / CVE-2025-9491 Windows shortcut display flaw to pad command-line arguments with whitespace, concealing an obfuscated PowerShell command executed through rundll32.exe while a decoy DOCX document is displayed to the victim.
Once deployed, BusySnake harvests browser-stored credentials (Firefox and Chromium via DPAPI), session cookies, clipboard content (including 2FA otpauth:// secrets), Telegram session data (tdata), cryptocurrency wallet JSON files, and any 64-character hexadecimal strings resembling private keys, while inventorying the file system into a local SQLite database (inventory_state.db) and collecting documents under 5MB from Desktop/Documents/Downloads. It abuses RustDesk (installing it if absent, or restarting it to force credential re-entry and screenshot capture if present) and establishes reverse SSH tunnels via infrastructure resembling the group's prior 'Go2Tunnel' tooling, requesting session parameters from https://grked.online/tunnel/create/.
Persistence is established through a VBScript (run.vbs) launching the stealer module (module.pyw), historically via direct schtasks invocation and, in a newer variant, via COM-based Schedule.Service task registration running every 5 minutes. The newer BusySnake variant also introduces a redesigned REST-style command-and-control API (/api/v1/client/{CLIENT_ID}/commands|tasks|files/) with task-status tracking (SCHEDULED/IN_PROGRESS/SUCCEEDED/FAILED), a pre-execution sleep function for sandbox evasion, in-memory Python execution with dynamic pip dependency installation, and dozens of named command handlers covering screenshot capture, keystroke-log exfiltration, browser/cookie/2FA/wallet theft, tdata exfiltration, and remote proxy/remote-control functions.
Kaspersky assesses with medium confidence that Armored Likho/Eagle Werewolf developed BusySnake and its supporting tooling, citing SSH tunneling command-line arguments identical to the group's prior Go2Tunnel implementation and structural handler-based architecture overlap with the group's AquilaRAT backdoor, previously distributed via a Rust dropper masquerading as a Starlink device-activation checklist on compromised drone-focused Telegram channels. Notably, first-stage loader code contains verbose comments and emoji bullet-points uncharacteristic of hand-written malware, suggesting the group used an LLM to help generate portions of its payloads.
MITRE ATT&CK techniques used in TL-2026-1097
Collection
T1005 Data from Local System; T1113 Screen Capture; T1115 Clipboard Data
Defense Evasion
T1027 Obfuscated Files or Information; T1027.002 Software Packing; T1027.010 Command Obfuscation; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1497.003 Time Based Checks; T1564.003 Hidden Window
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
Execution
T1059.001 PowerShell; T1059.005 Visual Basic; T1059.006 Python; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1572 Protocol Tunneling
Discovery
T1083 File and Directory Discovery
stealth
Credential Access
T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers
Initial Access
T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Resource Development
T1583.001 Domains; T1583.004 Server; T1587.001 Malware; T1588.002 Tool; T1608.001 Upload Malware
Affected products and versions in Armored Likho APT Deploys BusySnake Python Stealer with
- Microsoft — Windows (.lnk shortcut handling, all supported versions)
Vulnerable versions: Windows 10; Windows 11; Windows Server 2016-2025
Fixed in: Partial UI mitigation shipped November 2025 (Properties dialog now displays full Target command); underlying ZDI-CAN-25373 parsing behavior not formally patched
Remediation for Armored Likho APT Deploys BusySnake Python Stealer with
Patches
- Apply Microsoft's November 2025 update ensuring the .lnk Properties dialog displays the entire Target command with arguments (partial mitigation for ZDI-CAN-25373/CVE-2025-9491)
- No official Microsoft security patch exists for the underlying LNK parsing behavior as of this report; treat as unpatched
Immediate actions
- Block all identified C2 domains and IPs at DNS/firewall/proxy layer
- Hunt for rundll32.exe spawning obfuscated PowerShell command lines
- Inspect .lnk files for command-line arguments padded with excessive whitespace
- Block/monitor NSIS self-extracting archives and unsigned executables originating from email attachments
- Reset credentials and rotate RustDesk/Telegram/browser-stored credentials on any suspected host
Workarounds
- Disable or restrict execution of .lnk files delivered via email/removable media where feasible
- Restrict rundll32.exe execution via application control policies
- Block outbound connections to dynamic-DNS services (e.g. chickenkiller.com, twilightparadox.com) where not business-required
Longer-term hardening
- Deploy EDR with behavioral detection for Python (.pyw) execution, PyArmor-obfuscated payloads, and scheduled-task creation via COM (Schedule.Service)
- Enforce application allow-listing to block unsigned NSIS installers and unauthorized remote-access tools (RustDesk)
- Implement network egress monitoring/allow-listing for outbound SSH tunnels and REST-based C2 traffic
- User awareness training on government-notice, humanitarian-aid, and social-program themed phishing lures
- Deploy DMARC/SPF/DKIM and attachment sandboxing on email gateways for government and energy-sector mailboxes
CVEs associated with Armored Likho APT Deploys BusySnake Python Stealer with
Weaknesses (CWE) in Armored Likho APT Deploys BusySnake Python Stealer with
CWE-451, CWE-494, CWE-506
Timeline of Armored Likho APT Deploys BusySnake Python Stealer with
- Eagle Werewolf (Armored Likho) cluster activity traced back to at least May 2023, per BI.ZONE, targeting state organizations, industrial companies, and drone manufacturing/engineering personnel.
- Trend Micro's Zero Day Initiative reported the LNK shortcut display flaw (ZDI-CAN-25373) to Microsoft; Microsoft initially declined to service it as a traditional vulnerability.
- Trend Micro ZDI publicly disclosed ZDI-CAN-25373, documenting nearly 1,000 malicious LNK files and exploitation by at least 11 state-sponsored groups (North Korea, Iran, Russia, China) dating back to 2017.
- Help Net Security reported ZDI-CAN-25373 (CVE-2025-9491) remained actively exploited by APT groups nearly unpatched, underscoring its ongoing value to nation-state actors.
- Microsoft updated the .lnk Properties dialog to display the entire Target command regardless of length, a partial UI mitigation for command-line concealment without a formal patch to the underlying LNK parsing flaw.
- BI.ZONE detected an Eagle Werewolf espionage campaign using Starlink device-registration and drone-training lures to deliver AquilaRAT via a Rust dropper distributed through compromised drone-focused Telegram channels.
- Kaspersky confirmed BusySnake victims in Russia, Kazakhstan, and Brazil, delivered via spear-phishing lures themed as government notices, social-program applications, humanitarian aid, and debt-clearance certificates.
- Kaspersky documented a new BusySnake variant using a redesigned REST-style task-execution C2 API (/api/v1/client/{CLIENT_ID}/commands|tasks|files/), COM-based scheduled-task persistence, a sandbox-evasion sleep timer, and in-memory Python execution.
- Kaspersky Securelist publicly documented the previously unreported BusySnake Python infostealer, protected with PyArmor Pro v9.2.0, deployed by Armored Likho against government and electrical-power-sector targets.
Sources cited for Armored Likho APT Deploys BusySnake Python Stealer with
- Armored Likho APT with BusySnake Stealer
- ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day in Widespread APT Campaigns
- ZDI-25-148 Advisory
- Unpatched Windows vulnerability continues to be exploited by APTs (CVE-2025-9491)
- CVE-2025-9491 Detail
- Poisoned Windows shortcuts found to be a favorite of Chinese, Russian, N. Korean state hackers
- Windows Shortcut Zero-Day (ZDI-CAN-25373) Exploited by State-Backed Threat Actors Since 2017
- ZDI-CAN-25373: Serious zero-day hole in Windows shortcut is widely exploited
- ZDI-CAN-25373 – The Exploitable Windows Shortcut Vulnerability Behind Global Cyber Espionage Campaigns
- Cyber Espionage Group Targets Aviation Firms to Steal Map Data
- Core Werewolf targets the defense industry and critical infrastructure
Threats related to Armored Likho APT Deploys BusySnake Python Stealer with
- Armored Likho APT (Eagle Werewolf) Deploys AI-Generated Loaders to Drop BusySnake Python Stealer Against Government and Power-Sector Targets
- Armored Likho APT Targets Government and Power Sector with New BusySnake Stealer via CVE-2025-9491 LNK Abuse
- Operation HumanitarianBait — PyArmor-Packed Python Surveillance Implant Targeting Russian-Speakers via LNK/RAR Lures
- ACR Stealer (Amatera Stealer) Uses ClickFix Lures, WebDAV/pushd DLL Delivery, and EtherHiding to Harvest Browser and Microsoft 365 Data
- DNS Pivoting Reveals Shared Infrastructure Across LokiBot, Bagle, Xworm, and Remcos Campaigns
- Evolution of Remote Access Tool (RAT/RMM) Abuse: Multi-Stage Chaining of ConnectWise, GoTo, Datto, SimpleHelp, N-able, and Heartbeat RM
Detection coverage for TL-2026-1097
As of 2026-07-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1097 across Splunk SPL, Microsoft KQL and Sigma, covering 37 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.