Threat reportMalwareTL-2026-1260
Armored Likho APT (Eagle Werewolf) Deploys AI-Generated Loaders to Drop BusySnake Python Stealer Against Government and Power-Sector Targets
Armored Likho APT (Eagle Werewolf) Deploys AI-Generated (TL-2026-1260) is a high-severity malware campaign, first published 2026-07-13. It is attributed to Armored Likho with medium confidence, affects Microsoft Windows, references 1 CVE (CVE-2025-9491), maps to 30 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 48 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 30MITRE ATT&CK
- Actors
- 1Armored Likho
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 48Indicators of compromise
Key facts for TL-2026-1260
- Threat ID
- TL-2026-1260
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Armored Likho
- Attribution confidence
- MEDIUM
- Motivation
- ESPIONAGE
- Target sectors
- government administration, energy, electric power
- Target regions
- russia, brazil, kazakhstan
- Detection rules
- 9
- Indicators of compromise
- 48
Malware and tooling in Armored Likho APT (Eagle Werewolf) Deploys AI-Generated
Malware and tooling: AquilaRAT, BusySnake, Go2Tunnel, PyArmor Pro 9.2.0, RustDesk
How Armored Likho APT (Eagle Werewolf) Deploys AI-Generated works
Kaspersky (Securelist) uncovered a previously undocumented threat actor, Armored Likho — likely overlapping with Eagle Werewolf (tracked by BI.ZONE since May 2023) — running spear-phishing campaigns against government agencies and electrical power organizations in Russia, Brazil, and Kazakhstan. The group uses AI-generated first-stage loaders/stagers (identifiable by verbose comments and emoji bullet-points) to deploy a newly identified Python-based information stealer, BusySnake, which exfiltrates browser credentials, cookies, documents, OTP secrets, cryptocurrency wallet data, and Telegram sessions, and provides reverse SSH remote access via Go2Tunnel-derived tooling.
Armored Likho is a newly documented APT that blends financially motivated cybercrime against individuals with targeted cyber-espionage against government and critical-infrastructure organizations. Kaspersky Securelist attributes the campaign with medium confidence to Eagle Werewolf, a cluster tracked by BI.ZONE since May 2023 that has historically targeted government and defense organizations, including those involved in UAV development, and that distributed AquilaRAT via a compromised Telegram drone channel in February 2026. The attribution rests on architectural overlap between BusySnake's task-handler design and AquilaRAT's modular task execution framework, matching reverse-SSH tunnel implementation parameters consistent with the group's prior Go2Tunnel tool, and a persistent operational pattern of scheduled tasks masquerading as legitimate Windows utilities (named 'WindowsHelper').
The campaign begins with spear-phishing emails impersonating official government notices, humanitarian aid requests, debt-clearance notices, and social program communications, targeting victims in Russia, Brazil, and Kazakhstan. Two infection chains have been observed. In the first, victims open a RAR/ZIP archive (e.g., named around a 'psihologicheskiy_test' [psychological test] lure) containing a self-extracting NSIS executable. The dropper displays a decoy psychological-survey application while injecting code into a legitimate process (pnx.exe) and fetching additional payloads from GitHub repositories used as staging infrastructure, dropping them into %appdata%\WindowsHelper. The downloaded package includes a Python 3.12 interpreter, get-pip.py, the PyArmor Pro runtime, and the module.pyw stealer payload. A VBScript (wh_selfdelete.vbs) removes the initial loader while a second VBScript (run.vbs) launches module.pyw silently and installs a scheduled task that re-triggers execution every five minutes.
In the second chain, the archive instead contains a malicious Windows shortcut (.LNK) exploiting CVE-2025-9491 (ZDI-CAN-25373) — a flaw in how Windows' Explorer UI represents LNK file contents, allowing hazardous command-line data to be hidden from a user inspecting the file's properties. The obfuscated .LNK command line, padded with spaces and line breaks, invokes rundll32.exe to launch obfuscated PowerShell, which downloads the loader plus a decoy DOCX document (again themed around humanitarian aid or debt relief) while staging the same Python-based BusySnake payload in the background.
BusySnake itself is a Python-based information stealer distributed as an obfuscated .pyw file protected with PyArmor Pro 9.2.0, which dynamically decrypts and immediately re-encrypts individual functions at call time to frustrate static and dynamic analysis. It enforces single-instance execution via a lock file, then spins up parallel background workers: a clipboard logger that continuously harvests clipboard text (including OTP secrets matched via 'otpauth://' strings and 64-character hex strings that may represent cryptocurrency keys), a file-inventory worker that walks Desktop/Documents/Downloads and records metadata into a local SQLite database, and a document-exfiltration worker that uploads files under 5MB to the C2 server. It decrypts Firefox credentials via the NSS library's PK11SDR_Decrypt function and Chromium credentials via DPAPI, harvests browser cookies through both direct SQLite extraction and a supplementary browser-extension-based cookie module distributed separately via GitHub, and captures periodic screenshots. It also targets Telegram session data (tdata folder) and forces a restart of RustDesk remote-access software to capture re-entered credentials via screenshot. Command-and-control communication uses HTTP/HTTPS with a spoofed Chrome/Edge User-Agent string; the stealer polls a /get_task endpoint and reports execution status to /report_status with JSON bodies keyed by client_id. A newer BusySnake revision replaces raw schtasks.exe invocations with COM-based scheduled-task creation via win32com.client (Schedule.Service), adds an execution-delay routine before triggering malicious behavior to defeat sandboxes, splits command and script polling into separate poll_commands/poll_tasks loops hitting versioned REST-style endpoints (/api/v1/client/{CLIENT_ID}/commands/, /api/v1/client/{CLIENT_ID}/tasks/), and executes fetched Python scripts entirely in-memory without writing them to disk.
The most novel element of the campaign is the first-stage loader/stager code itself: Kaspersky researchers observed unusually verbose code comments and emoji bullet-points inconsistent with human malware-development norms, concluding the loaders were very likely generated with the assistance of large language models. Researchers assess this LLM-assisted development lets the group rapidly vary delivery-stage code across campaigns, complicating detection-signature reuse and attribution. Reverse-SSH tunneling infrastructure (echoing the group's prior standalone Go2Tunnel tool) gives operators persistent remote access to compromised hosts beyond simple data theft.
MITRE ATT&CK techniques used in TL-2026-1260
Collection
T1005 Data from Local System; T1113 Screen Capture; T1115 Clipboard Data; T1119 Automated Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1497.003 Time Based Checks
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
Execution
T1059.001 PowerShell; T1059.005 Visual Basic; T1059.006 Python; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1219 Remote Access Tools; T1572 Protocol Tunneling
Discovery
T1083 File and Directory Discovery; T1518 Software Discovery
Credential Access
T1111 Multi-Factor Authentication Interception; T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
stealth
Initial Access
T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Resource Development
T1583.006 Web Services; T1587.001 Malware
Impact
Affected products and versions in Armored Likho APT (Eagle Werewolf) Deploys AI-Generated
- Microsoft — Windows
Vulnerable versions: Windows 11 Enterprise 23H2 (10.0.22631.4169) and other unpatched Windows builds handling LNK file UI representation
Fixed in: Windows builds with the November 2025 patch for CVE-2025-9491 - N/A — Government agency and electric power sector endpoints (Windows)
Vulnerable versions: All Windows endpoints susceptible to spear-phishing delivery of NSIS/EXE droppers or malicious LNK files
Remediation for Armored Likho APT (Eagle Werewolf) Deploys AI-Generated
Patches
- Apply the Microsoft patch addressing CVE-2025-9491 (ZDI-CAN-25373) LNK file UI spoofing, released November 2025
Immediate actions
- Block all listed C2 domains and IP addresses at perimeter firewalls, secure web gateways, and DNS resolvers
- Treat unexpected archive attachments containing executables or .LNK files as high-risk, especially with government, humanitarian aid, debt-clearance, or social-program themes
- Alert on scheduled tasks named 'WindowsHelper' or created via win32com.client/Schedule.Service COM interfaces rather than schtasks.exe
- Hunt for %appdata%\WindowsHelper directory artifacts, module.pyw, wh_selfdelete.vbs, run.vbs, and PyArmor-protected Python payloads
- Search endpoint telemetry for outbound requests to /get_task, /report_status, /api/v1/client/*/commands/, /api/v1/client/*/tasks/ URL paths
Workarounds
- Restrict handling of .LNK files received via email/archives from external senders
- Disable or tightly control RustDesk and similar remote-access tools on sensitive endpoints
Longer-term hardening
- Deploy EDR with behavioral detection for rundll32.exe spawning PowerShell, and PowerShell spawning further child processes with obfuscated arguments
- Restrict or monitor GitHub as an unmanaged software-delivery channel from corporate endpoints
- Implement application allowlisting to block unsigned Python interpreters and PyArmor-protected scripts from user-writable AppData paths
- Deploy network detection for reverse SSH tunneling and non-standard tunneling tool signatures (Go2Tunnel-family)
- User-awareness training targeting government/humanitarian/social-program themed spear-phishing lures
CVEs associated with Armored Likho APT (Eagle Werewolf) Deploys AI-Generated
Weaknesses (CWE) in Armored Likho APT (Eagle Werewolf) Deploys AI-Generated
Timeline of Armored Likho APT (Eagle Werewolf) Deploys AI-Generated
- BI.ZONE begins tracking the Eagle Werewolf threat cluster, which historically targeted government and defense organizations, including those involved in UAV development.
- CVE-2025-9491 (ZDI-CAN-25373), a Windows LNK file UI-representation flaw later abused by the group's second infection chain, is published.
- Microsoft ships a patch addressing CVE-2025-9491, closing the LNK spoofing flaw used in Armored Likho's shortcut-based infection chain.
- Eagle Werewolf-linked AquilaRAT is distributed via a compromised Telegram drone/UAV channel, later cited by Kaspersky as part of the attribution linkage to Armored Likho.
- Kaspersky Securelist publishes 'Armored Likho's new weapon: BusySnake Stealer,' the primary technical report documenting the AI-generated loaders, BusySnake stealer internals, and full IOC set.
- Hackread, GBHackers, Cyberpress, and TechTimes publish secondary coverage summarizing the Securelist findings.
- The Hacker News and SecurityWeek publish additional coverage, adding detail on the Eagle Werewolf attribution linkage and CVE-2025-9491 exploitation.
- Cyber Security News publishes coverage of the campaign; TL-Intel Harness ingests the threat via RSS hunt for TL-2026-1260.
Sources cited for Armored Likho APT (Eagle Werewolf) Deploys AI-Generated
- Armored Likho's new weapon: BusySnake Stealer
- Armored Likho APT Uses AI-Generated Loaders
- Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer
- Armored Likho APT Targeting Government, Electric Power Entities
- Armored Likho Hits Government, Energy Sectors With BusySnake Stealer
- Armored Likho APT Deploys BusySnake Stealer Against Government and Power Sector Targets
- BusySnake Stealer Targets Browser Passwords, Cookies, Telegram Sessions, and Crypto Keys
- New APT Group Hits Power Grids in Three Countries with AI-Crafted Malware
- CVE-2025-9491 — Windows LNK File UI Misrepresentation (ZDI-CAN-25373)
Detection coverage for TL-2026-1260
As of 2026-07-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1260 across Splunk SPL, Microsoft KQL and Sigma, covering 48 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.