Armored Likho is a newly documented APT that blends financially motivated cybercrime against individuals with targeted cyber-espionage against government and critical-infrastructure organizations. Kaspersky Securelist attributes the campaign with medium confidence to Eagle Werewolf, a cluster tracked by BI.ZONE since May 2023 that has historically targeted government and defense organizations, including those involved in UAV development, and that distributed AquilaRAT via a compromised Telegram drone channel in February 2026. The attribution rests on architectural overlap between BusySnake's task-handler design and AquilaRAT's modular task execution framework, matching reverse-SSH tunnel implementation parameters consistent with the group's prior Go2Tunnel tool, and a persistent operational pattern of scheduled tasks masquerading as legitimate Windows utilities (named 'WindowsHelper').

The campaign begins with spear-phishing emails impersonating official government notices, humanitarian aid requests, debt-clearance notices, and social program communications, targeting victims in Russia, Brazil, and Kazakhstan. Two infection chains have been observed. In the first, victims open a RAR/ZIP archive (e.g., named around a 'psihologicheskiy_test' [psychological test] lure) containing a self-extracting NSIS executable. The dropper displays a decoy psychological-survey application while injecting code into a legitimate process (pnx.exe) and fetching additional payloads from GitHub repositories used as staging infrastructure, dropping them into %appdata%\WindowsHelper. The downloaded package includes a Python 3.12 interpreter, get-pip.py, the PyArmor Pro runtime, and the module.pyw stealer payload. A VBScript (wh_selfdelete.vbs) removes the initial loader while a second VBScript (run.vbs) launches module.pyw silently and installs a scheduled task that re-triggers execution every five minutes.

In the second chain, the archive instead contains a malicious Windows shortcut (.LNK) exploiting CVE-2025-9491 (ZDI-CAN-25373) — a flaw in how Windows' Explorer UI represents LNK file contents, allowing hazardous command-line data to be hidden from a user inspecting the file's properties. The obfuscated .LNK command line, padded with spaces and line breaks, invokes rundll32.exe to launch obfuscated PowerShell, which downloads the loader plus a decoy DOCX document (again themed around humanitarian aid or debt relief) while staging the same Python-based BusySnake payload in the background.

BusySnake itself is a Python-based information stealer distributed as an obfuscated .pyw file protected with PyArmor Pro 9.2.0, which dynamically decrypts and immediately re-encrypts individual functions at call time to frustrate static and dynamic analysis. It enforces single-instance execution via a lock file, then spins up parallel background workers: a clipboard logger that continuously harvests clipboard text (including OTP secrets matched via 'otpauth://' strings and 64-character hex strings that may represent cryptocurrency keys), a file-inventory worker that walks Desktop/Documents/Downloads and records metadata into a local SQLite database, and a document-exfiltration worker that uploads files under 5MB to the C2 server. It decrypts Firefox credentials via the NSS library's PK11SDR_Decrypt function and Chromium credentials via DPAPI, harvests browser cookies through both direct SQLite extraction and a supplementary browser-extension-based cookie module distributed separately via GitHub, and captures periodic screenshots. It also targets Telegram session data (tdata folder) and forces a restart of RustDesk remote-access software to capture re-entered credentials via screenshot. Command-and-control communication uses HTTP/HTTPS with a spoofed Chrome/Edge User-Agent string; the stealer polls a /get_task endpoint and reports execution status to /report_status with JSON bodies keyed by client_id. A newer BusySnake revision replaces raw schtasks.exe invocations with COM-based scheduled-task creation via win32com.client (Schedule.Service), adds an execution-delay routine before triggering malicious behavior to defeat sandboxes, splits command and script polling into separate poll_commands/poll_tasks loops hitting versioned REST-style endpoints (/api/v1/client/{CLIENT_ID}/commands/, /api/v1/client/{CLIENT_ID}/tasks/), and executes fetched Python scripts entirely in-memory without writing them to disk.

The most novel element of the campaign is the first-stage loader/stager code itself: Kaspersky researchers observed unusually verbose code comments and emoji bullet-points inconsistent with human malware-development norms, concluding the loaders were very likely generated with the assistance of large language models. Researchers assess this LLM-assisted development lets the group rapidly vary delivery-stage code across campaigns, complicating detection-signature reuse and attribution. Reverse-SSH tunneling infrastructure (echoing the group's prior standalone Go2Tunnel tool) gives operators persistent remote access to compromised hosts beyond simple data theft.