# Armored Likho APT Targets Government and Power Sector with New BusySnake Stealer via CVE-2025-9491 LNK Abuse

> A previously undocumented threat actor dubbed Armored Likho, overlapping with BI.ZONE-tracked cluster Eagle Werewolf (active since May 2023), is targeting government agencies and electric power sector organizations in Russia, Brazil, and Kazakhstan with a new Python-based infostealer, BusySnake Stealer. The group delivers the malware via spear-phishing RAR archives containing NSIS-built EXE droppers or malicious LNK shortcuts that abuse CVE-2025-9491 (ZDI-CAN-25373), staging payloads from GitHub and using an integrated Go2Tunnel reverse-SSH-tunneling feature for C2.

- **Published:** 2026-07-03T00:00:00Z
- **Last reviewed:** 2026-07-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1108
- **ID:** TL-2026-1108
- **Severity:** HIGH (CVSS 7)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Armored Likho
- **Detections:** 9 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-9491

## Description

Armored Likho is a previously undocumented threat actor first publicly named by Kaspersky (Securelist) on 3 July 2026, exhibiting substantial overlap with the BI.ZONE-tracked cluster 'Eagle Werewolf,' active since at least May 2023. The group runs two parallel operational tracks: targeted cyber-espionage against government agencies and electric-power-sector organizations, and financially motivated credential theft against private individuals, blending commodity techniques with bespoke tooling across Russia, Brazil, and Kazakhstan.

The group's primary implant is BusySnake Stealer, a Python-based infostealer packed with PyArmor Pro 9.2.0 (dynamic bytecode encryption with function-level re-encryption) and shipped with a .pyw extension so it executes without a visible console window. BusySnake harvests browser credentials (Firefox and Chromium-based browsers) via DPAPI decryption, steals cookies (with a supplementary browser-extension-based extraction module), continuously logs clipboard contents (including scraping for OTP/2FA keys), inventories the local filesystem for 64-character hex keys and cryptocurrency wallet JSON files, exfiltrates user documents under 5MB from Desktop/Documents/Downloads, periodically captures and archives screenshots, force-terminates and exfiltrates Telegram's tdata session directory, and harvests RustDesk remote-access credentials by screenshotting re-authentication prompts. It also supports dynamic, arbitrary Python script execution tasked from its C2 and establishes reverse SSH tunnels using attacker-supplied private keys via an integrated 'Go2Tunnel' capability, giving the operator persistent SOCKS-proxied remote access into the victim network.

Initial access is achieved via spear-phishing emails delivering RAR archives. Two infection paths have been observed: (1) an NSIS-built self-extracting EXE dropper disguised as a decoy 'psychological survey' that drops the legitimate binary pnx.exe and injects a malicious loader into its process memory; and (2) a malicious .lnk shortcut file that abuses CVE-2025-9491 (aka ZDI-CAN-25373), a Windows Shell Link UI-misrepresentation flaw that lets an attacker pad the LNK's COMMAND_LINE_ARGUMENTS with whitespace/non-printing characters so the Windows Properties dialog displays only an innocuous truncated command (the field is capped at 260 displayed characters even though the underlying string can run to tens of thousands), concealing an obfuscated PowerShell command that fetches and runs the loader. Both paths converge on a common staging sequence: download a Python 3.12 interpreter (python.zip), fetch get-pip.py, retrieve a data.zip archive containing the module.pyw stealer payload, install pip dependencies, and establish persistence via a scheduled task (initially named to masquerade as a system utility, e.g. 'WindowsHelper', executing every 5 minutes; a newer variant replaces raw schtasks calls with win32com.client COM automation for stealthier task creation). VBScript helpers (run.vbs, wh_selfdelete.vbs) handle execution and self-cleanup. Payloads are staged on GitHub repositories with automated release rotation to complicate takedown and blocklisting.

CVE-2025-9491/ZDI-CAN-25373 itself is not new: Trend Micro's Zero Day Initiative documented in March 2025 that at least 11 state-sponsored groups from North Korea, Iran, Russia, and China had exploited the same LNK UI-misrepresentation trick across nearly 1,000 malicious samples dating back to 2017, and in October 2025 Arctic Wolf disclosed the China-linked UNC6384 (Mustang Panda-associated) cluster exploiting it against European diplomatic targets in Hungary, Belgium, Italy, Serbia, and the Netherlands to deliver PlugX via DLL side-loading of a signed Canon utility. Microsoft silently patched the flaw in its November 2025 cumulative update — fixing the Properties dialog to display the full target command regardless of length — without issuing a dedicated advisory acknowledging active exploitation, a decision publicly criticized by 0patch and multiple outlets in December 2025.

Notably, Kaspersky researchers assess that Armored Likho's first-stage loader code was likely generated with the assistance of large language models: samples exhibit verbose, redundant inline comments and bullet-point emoji annotations atypical of human-authored malware. Attribution to a specific nation-state remains unestablished; Kaspersky assigns medium confidence to the Eagle Werewolf overlap based on shared Go2Tunnel SSH-argument patterns and structural parallels with the AquilaRAT toolset (both use scheduled tasks masquerading as system utilities and comparable C2 status-reporting endpoints). The campaign was reported as ongoing and active at time of publication.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.006 Python
- T1053.005 Scheduled Task
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1027.002 Software Packing
- T1036 Masquerading
- T1218.011 Rundll32
- T1564.003 Hidden Window
- T1070.004 File Deletion
- T1552.001 Credentials In Files
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1115 Clipboard Data
- T1113 Screen Capture
- T1560 Archive Collected Data
- T1005 Data from Local System
- T1119 Automated Collection
- T1071.001 Web Protocols
- T1572 Protocol Tunneling
- T1090.001 Internal Proxy
- T1573.002 Asymmetric Cryptography
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1583.006 Web Services
- T1588.001 Malware
- T1588.002 Tool

## Sources

- [Armored Likho's new weapon: BusySnake Stealer](https://securelist.com/tr/armored-likho-apt-with-busysnake-stealer/120292/)
- [Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer](https://thehackernews.com/2026/07/armored-likho-targets-government.html)
- [Armored Likho APT Deploys BusySnake Stealer Against Government and Power Sector Targets](https://gbhackers.com/busysnake-stealer-malware/)
- [BusySnake Stealer Targets Browser Passwords, Cookies, Telegram Sessions, and Crypto Keys](https://cyberpress.org/busysnake-stealer-malware/)
- [New APT Group Hits Power Grids in Three Countries with AI-Crafted Malware](https://www.techtimes.com/articles/319680/20260704/new-apt-group-hits-power-grids-three-countries-ai-crafted-malware.htm)
- [CVE-2025-9491 Detail](https://nvd.nist.gov/vuln/detail/CVE-2025-9491)
- [ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day in Widespread APT Campaigns](https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html)
- [APTs have been using zero-day Windows shortcut exploit for eight years (ZDI-CAN-25373)](https://www.helpnetsecurity.com/2025/03/19/apts-zero-day-windows-shortcut-vulnerability-exploit-zdi-can-25373/)
- [Unpatched Windows vulnerability continues to be exploited by APTs (CVE-2025-9491)](https://www.helpnetsecurity.com/2025/10/31/zdi-can-25373-cve-2025-9491-exploited-again/)
- [UNC6384 Weaponizes ZDI-CAN-25373 Vulnerability to Deploy PlugX Against Hungarian and Belgian Diplomatic Entities](https://arcticwolf.com/resources/blog/unc6384-weaponizes-zdi-can-25373-vulnerability-to-deploy-plugx/)
- [China-Linked Hackers Exploit Windows Shortcut Flaw to Target European Diplomats](https://thehackernews.com/2025/10/china-linked-hackers-exploit-windows.html)
- [Microsoft Silently Patched CVE-2025-9491 - We Think Our Patch Provides More Security](https://blog.0patch.com/2025/12/microsoft-silently-patched-cve-2025.html)
- [Microsoft fixes Windows shortcut flaw exploited for years](https://www.theregister.com/2025/12/04/microsoft_lnk_bug_fix)
- [Microsoft Silently Patches Windows LNK Flaw After Years of Active Exploitation](https://thehackernews.com/2025/12/microsoft-silently-patches-windows-lnk.html)
- [Microsoft Windows LNK File UI Misrepresentation Remote Code Execution](https://github.com/advisories/GHSA-6rf6-f9qg-8v94)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1108