# Armored Likho APT (Eagle Werewolf) Deploys AI-Generated Loaders to Drop BusySnake Python Stealer Against Government and Power-Sector Targets

> Kaspersky (Securelist) uncovered a previously undocumented threat actor, Armored Likho — likely overlapping with Eagle Werewolf (tracked by BI.ZONE since May 2023) — running spear-phishing campaigns against government agencies and electrical power organizations in Russia, Brazil, and Kazakhstan. The group uses AI-generated first-stage loaders/stagers (identifiable by verbose comments and emoji bullet-points) to deploy a newly identified Python-based information stealer, BusySnake, which exfiltrates browser credentials, cookies, documents, OTP secrets, cryptocurrency wallet data, and Telegram sessions, and provides reverse SSH remote access via Go2Tunnel-derived tooling.

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-07-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1260
- **ID:** TL-2026-1260
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Armored Likho
- **Detections:** 9 · **IOCs:** 48 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-9491

## Description

Armored Likho is a newly documented APT that blends financially motivated cybercrime against individuals with targeted cyber-espionage against government and critical-infrastructure organizations. Kaspersky Securelist attributes the campaign with medium confidence to Eagle Werewolf, a cluster tracked by BI.ZONE since May 2023 that has historically targeted government and defense organizations, including those involved in UAV development, and that distributed AquilaRAT via a compromised Telegram drone channel in February 2026. The attribution rests on architectural overlap between BusySnake's task-handler design and AquilaRAT's modular task execution framework, matching reverse-SSH tunnel implementation parameters consistent with the group's prior Go2Tunnel tool, and a persistent operational pattern of scheduled tasks masquerading as legitimate Windows utilities (named 'WindowsHelper').

The campaign begins with spear-phishing emails impersonating official government notices, humanitarian aid requests, debt-clearance notices, and social program communications, targeting victims in Russia, Brazil, and Kazakhstan. Two infection chains have been observed. In the first, victims open a RAR/ZIP archive (e.g., named around a 'psihologicheskiy_test' [psychological test] lure) containing a self-extracting NSIS executable. The dropper displays a decoy psychological-survey application while injecting code into a legitimate process (pnx.exe) and fetching additional payloads from GitHub repositories used as staging infrastructure, dropping them into %appdata%\WindowsHelper. The downloaded package includes a Python 3.12 interpreter, get-pip.py, the PyArmor Pro runtime, and the module.pyw stealer payload. A VBScript (wh_selfdelete.vbs) removes the initial loader while a second VBScript (run.vbs) launches module.pyw silently and installs a scheduled task that re-triggers execution every five minutes.

In the second chain, the archive instead contains a malicious Windows shortcut (.LNK) exploiting CVE-2025-9491 (ZDI-CAN-25373) — a flaw in how Windows' Explorer UI represents LNK file contents, allowing hazardous command-line data to be hidden from a user inspecting the file's properties. The obfuscated .LNK command line, padded with spaces and line breaks, invokes rundll32.exe to launch obfuscated PowerShell, which downloads the loader plus a decoy DOCX document (again themed around humanitarian aid or debt relief) while staging the same Python-based BusySnake payload in the background.

BusySnake itself is a Python-based information stealer distributed as an obfuscated .pyw file protected with PyArmor Pro 9.2.0, which dynamically decrypts and immediately re-encrypts individual functions at call time to frustrate static and dynamic analysis. It enforces single-instance execution via a lock file, then spins up parallel background workers: a clipboard logger that continuously harvests clipboard text (including OTP secrets matched via 'otpauth://' strings and 64-character hex strings that may represent cryptocurrency keys), a file-inventory worker that walks Desktop/Documents/Downloads and records metadata into a local SQLite database, and a document-exfiltration worker that uploads files under 5MB to the C2 server. It decrypts Firefox credentials via the NSS library's PK11SDR_Decrypt function and Chromium credentials via DPAPI, harvests browser cookies through both direct SQLite extraction and a supplementary browser-extension-based cookie module distributed separately via GitHub, and captures periodic screenshots. It also targets Telegram session data (tdata folder) and forces a restart of RustDesk remote-access software to capture re-entered credentials via screenshot. Command-and-control communication uses HTTP/HTTPS with a spoofed Chrome/Edge User-Agent string; the stealer polls a /get_task endpoint and reports execution status to /report_status with JSON bodies keyed by client_id. A newer BusySnake revision replaces raw schtasks.exe invocations with COM-based scheduled-task creation via win32com.client (Schedule.Service), adds an execution-delay routine before triggering malicious behavior to defeat sandboxes, splits command and script polling into separate poll_commands/poll_tasks loops hitting versioned REST-style endpoints (/api/v1/client/{CLIENT_ID}/commands/, /api/v1/client/{CLIENT_ID}/tasks/), and executes fetched Python scripts entirely in-memory without writing them to disk.

The most novel element of the campaign is the first-stage loader/stager code itself: Kaspersky researchers observed unusually verbose code comments and emoji bullet-points inconsistent with human malware-development norms, concluding the loaders were very likely generated with the assistance of large language models. Researchers assess this LLM-assisted development lets the group rapidly vary delivery-stage code across campaigns, complicating detection-signature reuse and attribution. Reverse-SSH tunneling infrastructure (echoing the group's prior standalone Go2Tunnel tool) gives operators persistent remote access to compromised hosts beyond simple data theft.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1059.006 Python
- T1218.011 Rundll32
- T1053.005 Scheduled Task
- T1027 Obfuscated Files or Information
- T1055 Process Injection
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1070.004 File Deletion
- T1497.003 Time Based Checks
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1111 Multi-Factor Authentication Interception
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1115 Clipboard Data
- T1113 Screen Capture
- T1119 Automated Collection
- T1071.001 Web Protocols
- T1572 Protocol Tunneling
- T1219 Remote Access Tools
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft
- T1587.001 Malware
- T1583.006 Web Services

## Sources

- [Armored Likho's new weapon: BusySnake Stealer](https://securelist.com/tr/armored-likho-apt-with-busysnake-stealer/120292/)
- [Armored Likho APT Uses AI-Generated Loaders](https://cybersecuritynews.com/armored-likho-apt-uses-ai-generated-loaders/)
- [Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer](https://thehackernews.com/2026/07/armored-likho-targets-government.html)
- [Armored Likho APT Targeting Government, Electric Power Entities](https://www.securityweek.com/armored-likho-apt-targeting-government-electric-power-entities/)
- [Armored Likho Hits Government, Energy Sectors With BusySnake Stealer](https://hackread.com/armored-likho-government-energy-busysnake-stealer/)
- [Armored Likho APT Deploys BusySnake Stealer Against Government and Power Sector Targets](https://gbhackers.com/busysnake-stealer-malware/)
- [BusySnake Stealer Targets Browser Passwords, Cookies, Telegram Sessions, and Crypto Keys](https://cyberpress.org/busysnake-stealer-malware/)
- [New APT Group Hits Power Grids in Three Countries with AI-Crafted Malware](https://www.techtimes.com/articles/319680/20260704/new-apt-group-hits-power-grids-three-countries-ai-crafted-malware.htm)
- [CVE-2025-9491 — Windows LNK File UI Misrepresentation (ZDI-CAN-25373)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-9491)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1260