Threat reportMalwareTL-2026-1108
Armored Likho APT Targets Government and Power Sector with New BusySnake Stealer via CVE-2025-9491 LNK Abuse
Armored Likho APT Targets Government and Power Sector with (TL-2026-1108) is a high-severity malware campaign scored CVSS 7, first published 2026-07-03. It is attributed to Armored Likho with medium confidence, affects Microsoft Windows Shell Link (.lnk) handling, references 1 CVE (CVE-2025-9491), maps to 31 MITRE ATT&CK techniques (T1005, T1027, T1027.002), and is covered by 9 detection rules and 35 indicators of compromise.
- CVSS
- 7/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 31MITRE ATT&CK
- Actors
- 1Armored Likho
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 35Indicators of compromise
Key facts for TL-2026-1108
- Threat ID
- TL-2026-1108
- Severity
- HIGH
- CVSS
- 7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Armored Likho
- Attribution confidence
- MEDIUM
- Motivation
- ESPIONAGE
- Target sectors
- government administration, energy, criticalinfrastructure, electricpower
- Target regions
- russia, brazil, kazakhstan
- Detection rules
- 9
- Indicators of compromise
- 35
Malware and tooling in Armored Likho APT Targets Government and Power Sector with
Malware and tooling: AquilaRAT, BusySnake Stealer, Go2Tunnel, PyArmor Pro 9.2.0
How Armored Likho APT Targets Government and Power Sector with works
A previously undocumented threat actor dubbed Armored Likho, overlapping with BI.ZONE-tracked cluster Eagle Werewolf (active since May 2023), is targeting government agencies and electric power sector organizations in Russia, Brazil, and Kazakhstan with a new Python-based infostealer, BusySnake Stealer. The group delivers the malware via spear-phishing RAR archives containing NSIS-built EXE droppers or malicious LNK shortcuts that abuse CVE-2025-9491 (ZDI-CAN-25373), staging payloads from GitHub and using an integrated Go2Tunnel reverse-SSH-tunneling feature for C2.
Armored Likho is a previously undocumented threat actor first publicly named by Kaspersky (Securelist) on 3 July 2026, exhibiting substantial overlap with the BI.ZONE-tracked cluster 'Eagle Werewolf,' active since at least May 2023. The group runs two parallel operational tracks: targeted cyber-espionage against government agencies and electric-power-sector organizations, and financially motivated credential theft against private individuals, blending commodity techniques with bespoke tooling across Russia, Brazil, and Kazakhstan.
The group's primary implant is BusySnake Stealer, a Python-based infostealer packed with PyArmor Pro 9.2.0 (dynamic bytecode encryption with function-level re-encryption) and shipped with a .pyw extension so it executes without a visible console window. BusySnake harvests browser credentials (Firefox and Chromium-based browsers) via DPAPI decryption, steals cookies (with a supplementary browser-extension-based extraction module), continuously logs clipboard contents (including scraping for OTP/2FA keys), inventories the local filesystem for 64-character hex keys and cryptocurrency wallet JSON files, exfiltrates user documents under 5MB from Desktop/Documents/Downloads, periodically captures and archives screenshots, force-terminates and exfiltrates Telegram's tdata session directory, and harvests RustDesk remote-access credentials by screenshotting re-authentication prompts. It also supports dynamic, arbitrary Python script execution tasked from its C2 and establishes reverse SSH tunnels using attacker-supplied private keys via an integrated 'Go2Tunnel' capability, giving the operator persistent SOCKS-proxied remote access into the victim network.
Initial access is achieved via spear-phishing emails delivering RAR archives. Two infection paths have been observed: (1) an NSIS-built self-extracting EXE dropper disguised as a decoy 'psychological survey' that drops the legitimate binary pnx.exe and injects a malicious loader into its process memory; and (2) a malicious .lnk shortcut file that abuses CVE-2025-9491 (aka ZDI-CAN-25373), a Windows Shell Link UI-misrepresentation flaw that lets an attacker pad the LNK's COMMAND_LINE_ARGUMENTS with whitespace/non-printing characters so the Windows Properties dialog displays only an innocuous truncated command (the field is capped at 260 displayed characters even though the underlying string can run to tens of thousands), concealing an obfuscated PowerShell command that fetches and runs the loader. Both paths converge on a common staging sequence: download a Python 3.12 interpreter (python.zip), fetch get-pip.py, retrieve a data.zip archive containing the module.pyw stealer payload, install pip dependencies, and establish persistence via a scheduled task (initially named to masquerade as a system utility, e.g. 'WindowsHelper', executing every 5 minutes; a newer variant replaces raw schtasks calls with win32com.client COM automation for stealthier task creation). VBScript helpers (run.vbs, wh_selfdelete.vbs) handle execution and self-cleanup. Payloads are staged on GitHub repositories with automated release rotation to complicate takedown and blocklisting.
CVE-2025-9491/ZDI-CAN-25373 itself is not new: Trend Micro's Zero Day Initiative documented in March 2025 that at least 11 state-sponsored groups from North Korea, Iran, Russia, and China had exploited the same LNK UI-misrepresentation trick across nearly 1,000 malicious samples dating back to 2017, and in October 2025 Arctic Wolf disclosed the China-linked UNC6384 (Mustang Panda-associated) cluster exploiting it against European diplomatic targets in Hungary, Belgium, Italy, Serbia, and the Netherlands to deliver PlugX via DLL side-loading of a signed Canon utility. Microsoft silently patched the flaw in its November 2025 cumulative update — fixing the Properties dialog to display the full target command regardless of length — without issuing a dedicated advisory acknowledging active exploitation, a decision publicly criticized by 0patch and multiple outlets in December 2025.
Notably, Kaspersky researchers assess that Armored Likho's first-stage loader code was likely generated with the assistance of large language models: samples exhibit verbose, redundant inline comments and bullet-point emoji annotations atypical of human-authored malware. Attribution to a specific nation-state remains unestablished; Kaspersky assigns medium confidence to the Eagle Werewolf overlap based on shared Go2Tunnel SSH-argument patterns and structural parallels with the AquilaRAT toolset (both use scheduled tasks masquerading as system utilities and comparable C2 status-reporting endpoints). The campaign was reported as ongoing and active at time of publication.
MITRE ATT&CK techniques used in TL-2026-1108
Collection
T1005 Data from Local System; T1113 Screen Capture; T1115 Clipboard Data; T1119 Automated Collection; T1560 Archive Collected Data
Defense Evasion
T1027 Obfuscated Files or Information; T1027.002 Software Packing; T1036 Masquerading; T1055 Process Injection; T1070.004 File Deletion; T1218.011 Rundll32; T1564.003 Hidden Window
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
Discovery
T1057 Process Discovery; T1083 File and Directory Discovery
Execution
T1059.001 PowerShell; T1059.006 Python; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1090.001 Internal Proxy; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling; T1573.002 Asymmetric Cryptography
Credential Access
T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers
Initial Access
T1566.001 Spearphishing Attachment
Resource Development
Affected products and versions in Armored Likho APT Targets Government and Power Sector with
- Microsoft — Windows Shell Link (.lnk) handling
Vulnerable versions: Windows 10; Windows 11; Windows Server 2016; Windows Server 2019; Windows Server 2022
Fixed in: Windows builds with the November 2025 cumulative update (silent fix, no dedicated KB issued) - Mozilla — Firefox
Vulnerable versions: all versions with locally stored credential databases - Multiple — Chromium-based browsers (Chrome, Edge, Brave)
Vulnerable versions: all versions using DPAPI-protected credential stores - Telegram FZ-LLC — Telegram Desktop
Vulnerable versions: all versions storing local tdata session directory - Purslane Ltd — RustDesk
Vulnerable versions: all versions using on-screen re-authentication prompts
Remediation for Armored Likho APT Targets Government and Power Sector with
Patches
- Install Microsoft's November 2025 Windows update that fixes the .lnk Properties dialog truncation flaw (no dedicated KB was issued; the patch shipped silently)
- Consider the 0patch micropatch for CVE-2025-9491 on systems that cannot immediately apply the Microsoft update
Immediate actions
- Block identified C2 domains and IP addresses at perimeter firewall/DNS/proxy layer
- Apply the November 2025 Windows cumulative update that silently corrected the LNK Properties dialog truncation flaw (CVE-2025-9491/ZDI-CAN-25373)
- Quarantine and analyze any RAR/ZIP archives containing LNK or NSIS-built EXE files matching identified hashes
- Hunt for and terminate scheduled tasks named 'WindowsHelper' or similar system-utility-masquerading names executing every 5 minutes
- Reset credentials and rotate tokens on any host where BusySnake Stealer hashes were observed
Workarounds
- Block LNK file execution from Downloads/Temp/mail-attachment paths via AppLocker/WDAC
- Inspect .lnk files' raw binary COMMAND_LINE_ARGUMENTS structure rather than relying on the Windows Properties dialog for verification
Longer-term hardening
- Deploy EDR with behavioral detection for LNK abuse, Python interpreter droppers, and reverse SSH tunnel establishment
- Enforce email gateway inspection of RAR/ZIP attachments and block LNK files in email at the gateway
- Implement application allowlisting to prevent execution of unauthorized Python interpreters and NSIS-built binaries
- Deploy network egress filtering and monitor for SSH connections (standard and non-standard ports) to unfamiliar external hosts
- Conduct user awareness training on spear-phishing lures themed as psychological surveys and humanitarian aid applications
CVEs associated with Armored Likho APT Targets Government and Power Sector with
Weaknesses (CWE) in Armored Likho APT Targets Government and Power Sector with
Timeline of Armored Likho APT Targets Government and Power Sector with
- Trend Micro's Zero Day Initiative later determines that malicious .lnk samples exploiting the ZDI-CAN-25373 UI-misrepresentation trick (later CVE-2025-9491) date back to 2017, eventually cataloging nearly 1,000 such samples across multiple threat actors.
- BI.ZONE begins tracking the 'Eagle Werewolf' threat cluster, which Kaspersky later assesses may overlap with Armored Likho based on shared tooling patterns.
- Trend Micro publishes research showing at least 11 state-sponsored threat groups from North Korea, Iran, Russia, and China have exploited the ZDI-CAN-25373 LNK flaw in espionage and financially motivated operations.
- CVE-2025-9491 (Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability, CWE-451) is published in the NVD.
- Arctic Wolf Labs discloses that China-linked UNC6384 (associated with Mustang Panda) exploited CVE-2025-9491 against European diplomatic entities in Hungary, Belgium, Italy, Serbia, and the Netherlands to deliver PlugX via DLL side-loading.
- NVD record for CVE-2025-9491 is modified as continued disclosure of active exploitation accumulates.
- 0patch and multiple outlets report that Microsoft silently patched CVE-2025-9491 in its November 2025 cumulative update, fixing the LNK Properties dialog to display the full target command, without acknowledging prior active exploitation.
- The Hacker News, gbhackers, and cyberpress.org publish corroborating coverage of the Armored Likho/BusySnake Stealer campaign the same day as the Securelist report.
- Kaspersky (Securelist) publicly names the Armored Likho threat actor and details the BusySnake Stealer campaign targeting government and electric-power-sector organizations in Russia, Brazil, and Kazakhstan.
- Tech Times and other outlets report on Armored Likho's apparent use of LLM-generated malware loader code in attacks targeting power grid operators.
- Kaspersky assesses the Armored Likho/BusySnake Stealer campaign remains active at time of publication, with ongoing monitoring by researchers.
Sources cited for Armored Likho APT Targets Government and Power Sector with
- Armored Likho's new weapon: BusySnake Stealer
- Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer
- Armored Likho APT Deploys BusySnake Stealer Against Government and Power Sector Targets
- BusySnake Stealer Targets Browser Passwords, Cookies, Telegram Sessions, and Crypto Keys
- New APT Group Hits Power Grids in Three Countries with AI-Crafted Malware
- CVE-2025-9491 Detail
- ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day in Widespread APT Campaigns
- APTs have been using zero-day Windows shortcut exploit for eight years (ZDI-CAN-25373)
- Unpatched Windows vulnerability continues to be exploited by APTs (CVE-2025-9491)
- UNC6384 Weaponizes ZDI-CAN-25373 Vulnerability to Deploy PlugX Against Hungarian and Belgian Diplomatic Entities
- China-Linked Hackers Exploit Windows Shortcut Flaw to Target European Diplomats
- Microsoft Silently Patched CVE-2025-9491 - We Think Our Patch Provides More Security
- Microsoft fixes Windows shortcut flaw exploited for years
- Microsoft Silently Patches Windows LNK Flaw After Years of Active Exploitation
- Microsoft Windows LNK File UI Misrepresentation Remote Code Execution
Detection coverage for TL-2026-1108
As of 2026-07-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1108 across Splunk SPL, Microsoft KQL and Sigma, covering 35 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.