# Armored Likho APT Deploys BusySnake Python Stealer with PyArmor Obfuscation Against Government and Power Infrastructure Targets

> Kaspersky Securelist reports the Armored Likho (aka Eagle Werewolf) threat actor remains highly active, deploying a new Python-based infostealer dubbed BusySnake against government agencies and electrical power infrastructure using PyArmor Pro v9.2.0 obfuscation, NSIS self-extracting droppers, and ZDI-CAN-25373/CVE-2025-9491 LNK exploitation, with confirmed victims in Russia, Kazakhstan, and Brazil.

- **Published:** 2026-07-03T00:00:00Z
- **Last reviewed:** 2026-07-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1097
- **ID:** TL-2026-1097
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Armored Likho
- **Detections:** 9 · **IOCs:** 37 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-9491

## Description

Armored Likho (aka Eagle Werewolf), a cyberespionage cluster tracked by Kaspersky and previously documented by BI.ZONE, continues an active campaign against government agencies and electrical power infrastructure operators, with confirmed victims identified in Russia, Kazakhstan, and Brazil. The group's newest tool, a Python-based infostealer dubbed BusySnake, is protected with PyArmor Pro v9.2.0, which dynamically decrypts bytecode at function-call time and immediately re-encrypts it afterward, and ships as a .pyw file that runs without a visible console window.

Initial access is achieved via spear-phishing emails carrying self-extracting NSIS archives (e.g. disguised as a 'psychological test' - psihologicheskiy_test.exe) that display a decoy application while injecting code into a legitimate spawned process (pnx.exe) and fetching second-stage payloads from GitHub repositories, and via malicious .lnk shortcut files that abuse the ZDI-CAN-25373 / CVE-2025-9491 Windows shortcut display flaw to pad command-line arguments with whitespace, concealing an obfuscated PowerShell command executed through rundll32.exe while a decoy DOCX document is displayed to the victim.

Once deployed, BusySnake harvests browser-stored credentials (Firefox and Chromium via DPAPI), session cookies, clipboard content (including 2FA otpauth:// secrets), Telegram session data (tdata), cryptocurrency wallet JSON files, and any 64-character hexadecimal strings resembling private keys, while inventorying the file system into a local SQLite database (inventory_state.db) and collecting documents under 5MB from Desktop/Documents/Downloads. It abuses RustDesk (installing it if absent, or restarting it to force credential re-entry and screenshot capture if present) and establishes reverse SSH tunnels via infrastructure resembling the group's prior 'Go2Tunnel' tooling, requesting session parameters from https://grked.online/tunnel/create/.

Persistence is established through a VBScript (run.vbs) launching the stealer module (module.pyw), historically via direct schtasks invocation and, in a newer variant, via COM-based Schedule.Service task registration running every 5 minutes. The newer BusySnake variant also introduces a redesigned REST-style command-and-control API (/api/v1/client/{CLIENT_ID}/commands|tasks|files/) with task-status tracking (SCHEDULED/IN_PROGRESS/SUCCEEDED/FAILED), a pre-execution sleep function for sandbox evasion, in-memory Python execution with dynamic pip dependency installation, and dozens of named command handlers covering screenshot capture, keystroke-log exfiltration, browser/cookie/2FA/wallet theft, tdata exfiltration, and remote proxy/remote-control functions.

Kaspersky assesses with medium confidence that Armored Likho/Eagle Werewolf developed BusySnake and its supporting tooling, citing SSH tunneling command-line arguments identical to the group's prior Go2Tunnel implementation and structural handler-based architecture overlap with the group's AquilaRAT backdoor, previously distributed via a Rust dropper masquerading as a Starlink device-activation checklist on compromised drone-focused Telegram channels. Notably, first-stage loader code contains verbose comments and emoji bullet-points uncharacteristic of hand-written malware, suggesting the group used an LLM to help generate portions of its payloads.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.004 Server
- T1587.001 Malware
- T1588.002 Tool
- T1608.001 Upload Malware
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.006 Python
- T1059.005 Visual Basic
- T1218.011 Rundll32
- T1053.005 Scheduled Task
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1027.002 Software Packing
- T1027.010 Command Obfuscation
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1497.003 Time Based Checks
- T1564.003 Hidden Window
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1552.001 Credentials In Files
- T1083 File and Directory Discovery
- T1113 Screen Capture
- T1115 Clipboard Data
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1572 Protocol Tunneling
- T1090 Proxy
- T1105 Ingress Tool Transfer
- T1219 Remote Access Tools
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel

## Sources

- [Armored Likho APT with BusySnake Stealer](https://securelist.com/tr/armored-likho-apt-with-busysnake-stealer/120292/)
- [ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day in Widespread APT Campaigns](https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html)
- [ZDI-25-148 Advisory](https://www.zerodayinitiative.com/advisories/ZDI-25-148/)
- [Unpatched Windows vulnerability continues to be exploited by APTs (CVE-2025-9491)](https://www.helpnetsecurity.com/2025/10/31/zdi-can-25373-cve-2025-9491-exploited-again/)
- [CVE-2025-9491 Detail](https://nvd.nist.gov/vuln/detail/CVE-2025-9491)
- [Poisoned Windows shortcuts found to be a favorite of Chinese, Russian, N. Korean state hackers](https://therecord.media/windows-lnk-files-nation-state-hacking-campaigns)
- [Windows Shortcut Zero-Day (ZDI-CAN-25373) Exploited by State-Backed Threat Actors Since 2017](https://socradar.io/blog/windows-shortcut-zero-day-zdi-can-25373-exploited/)
- [ZDI-CAN-25373: Serious zero-day hole in Windows shortcut is widely exploited](https://fpt-is.com/en/insights/zdi-can-25373-serious-zero-day-hole-in-windows-shortcut-is-widely-exploited/)
- [ZDI-CAN-25373 – The Exploitable Windows Shortcut Vulnerability Behind Global Cyber Espionage Campaigns](https://cybersrcc.com/2025/03/19/zdi-can-25373-the-exploitable-windows-shortcut-vulnerability-behind-global-cyber-espionage-campaigns/)
- [Cyber Espionage Group Targets Aviation Firms to Steal Map Data](https://www.darkreading.com/vulnerabilities-threats/cyber-espionage-group-aviation-firms-steal-map-data)
- [Core Werewolf targets the defense industry and critical infrastructure](https://bi.zone/eng/expertise/blog/core-werewolf-protiv-opk-i-kriticheskoy-infrastruktury/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1097