# Armored Likho APT Deploys Advanced Python Stealer Against Government and Critical Infrastructure


New threat actor combining modular malware, sophisticated evasion techniques, and spear-phishing to target state entities and power grids across Russia, Brazil, and Kazakhstan


Cybersecurity researchers at Kaspersky have identified a previously undocumented advanced persistent threat (APT) actor dubbed Armored Likho, which has been conducting targeted operations against government agencies and electric power infrastructure across multiple countries. The group demonstrates a sophisticated approach to cyberattacks, deploying a modular malware arsenal that combines financially motivated campaigns against individuals with intelligence-gathering operations against critical infrastructure operators.


The discovery reveals a threat actor with capabilities comparable to established nation-state and criminal APT groups, featuring a diverse toolkit that emphasizes stealth, persistence, and adaptive functionality. Armored Likho's operations suggest a financially motivated actor with potential state-sponsored interests, operating with knowledge of both targeting opportunities and victim network architectures.


## The Threat: Armored Likho's Operational Profile


Armored Likho operates across Russia, Brazil, and Kazakhstan, targeting government entities, electric power organizations, and high-value individuals. The group's operational model suggests a hybrid threat profile: while some campaigns appear financially motivated—targeting individuals for credential theft and direct financial gain—other operations align with cyber-espionage objectives against critical infrastructure.


Kaspersky's analysis indicates the actor maintains a disciplined operational security posture and has likely been operating undetected for an extended period before discovery. The group's ability to maintain control across multiple victim networks, coupled with its sophisticated malware delivery mechanisms, suggests adequate resources and technical expertise consistent with organized cybercrime syndicates or state-aligned threat actors.


Notable attribution details include operational overlap with Eagle Werewolf, another tracked APT group previously known for deploying the AquilaRAT remote access trojan. This overlap suggests either shared infrastructure, tactics, or possible organizational relationships between the groups.


## Technical Arsenal: Modular Malware and Evasion Tactics


Armored Likho's malware toolkit represents a significant investment in modular, adaptable capabilities:


### Core Malware Components


BusySnake Stealer (Python-based information stealer)

  • Dynamically decrypts bytecode at function execution, immediately re-encrypting afterward
  • Runs in background process without visible console window
  • Implements multiple specialized handlers for distinct theft operations
  • Supports modular plugin architecture for extended functionality

    • Go2Tunnel (Network tunneling and remote access)

  • Establishes reverse SSH tunnels for persistent remote access
  • Enables interactive command execution on compromised systems
  • Functionality has been integrated into newer BusySnake variants

    • Execution Framework

  • In-memory loaders that inject malicious code directly into system memory
  • Fetches secondary payloads from GitHub repositories hosting what appear to be legitimate development builds
  • Leverages legitimate platforms (GitHub) for command-and-control infrastructure, reducing detection likelihood

    • ### Evasion and Persistence Mechanisms


    The malware employs sophisticated anti-analysis techniques:


  • Bytecode encryption/decryption cycles prevent static analysis and signature-based detection
  • Living-off-the-land execution using legitimate Python 3.12 interpreters and system utilities
  • Fake document decoys displayed to users while malicious payload installation proceeds silently
  • Command-driven capability deployment allowing attackers to selectively activate functions based on victim profile and operational objectives

    • ## Attack Methods: Spear-Phishing and Infection Chain


    Armored Likho's initial access strategy relies on spear-phishing with archive attachments containing either executable files or LNK (link) files masquerading as documents.


    ### Typical Infection Sequence


    1. Malicious email delivery with crafted attachment targeting specific organization or individual

    2. Deceptive document display to victim while background installation proceeds

    3. Multi-stage payload fetch – archives downloaded from GitHub repositories containing:

    - Python 3.12 interpreter (legitimate, but repurposed)

    - Encrypted malware modules

    - Configuration files and secondary payloads

    4. In-memory injection of loader component, avoiding disk-based detection

    5. Stealer activation and C&C communication establishment


    ## Capabilities: From Reconnaissance to Persistent Control


    Once established on a victim system, BusySnake Stealer can execute the following operations based on C&C server commands:


    | Capability | Purpose | Risk Level |

    |-----------|---------|-----------|

    | Screenshot capture & archiving | Visual reconnaissance of user activity | HIGH |

    | Keystroke logging | Capture of credentials and sensitive communications | CRITICAL |

    | Browser credential theft | Extract passwords from Chromium and Firefox | CRITICAL |

    | Cookie exfiltration | Session hijacking and account takeover | CRITICAL |

    | OTP key extraction | Bypass of multi-factor authentication | CRITICAL |

    | Cryptocurrency wallet discovery | Direct financial theft | HIGH |

    | Telegram session harvesting | Access to encrypted communications | HIGH |

    | RustDesk exploitation | Installation of additional remote-access tools | HIGH |

    | Reverse SSH tunneling | Persistent remote access and interactive control | CRITICAL |


    This capability profile indicates attackers with interest in both immediate financial gain (credentials, wallets, session tokens) and long-term persistent access enabling espionage operations.


    ## Implications: Critical Infrastructure and Government Risk


    The targeting of government agencies and electric power organizations elevates Armored Likho beyond typical cybercriminal threats. Several critical implications emerge:


    For Power Grid Operators:

  • If BusySnake gains access to administrative systems, attackers could move laterally to operational technology (OT) networks
  • Compromised credentials of power system operators create direct disruption risk
  • The group's apparent interest in persistent access suggests potential preparation for disruptive operations

    • For Government Entities:

  • State organizations in targeted countries face intelligence collection threats
  • Encrypted communications (Telegram) and stored credentials represent espionage priorities
  • The use of GitHub repositories for C&C infrastructure reduces attribution complexity but enables rapid redeployment

    • For Targeted Individuals:

  • High-net-worth individuals, business executives, and political figures face financial and personal security risks
  • Cryptocurrency holdings represent direct theft targets
  • Keylogging and session theft enable identity assumption and fraud

    • Regional Impact:

  • Russia, Brazil, and Kazakhstan as primary targets suggest regional threat actors or nation-state operators with these geographic focuses
  • Potential overlap with geopolitical tensions or regional industrial disputes

    • ## Defense Recommendations


    Organizations in affected regions or operating critical infrastructure should implement:


    1. Email Security Controls

    - Block executable and LNK file attachments

    - Implement sandboxing for suspicious archives

    - Deploy advanced phishing detection targeting spear-phishing campaigns


    2. Endpoint Detection and Response (EDR)

    - Monitor for Python 3.12 process execution in unexpected contexts

    - Flag GitHub repository downloads on non-developer systems

    - Alert on reverse SSH tunnel establishment and RustDesk installations


    3. Credential Management

    - Enforce hardware-backed multi-factor authentication resistant to OTP extraction

    - Implement browser credential manager protections or passwordless authentication

    - Monitor for suspicious credential access patterns


    4. Network Monitoring

    - Establish network baseline for lateral movement detection

    - Monitor for unusual data exfiltration patterns

    - Segment critical infrastructure networks to limit attacker mobility


    5. Incident Response

    - Assume breach if BusySnake is detected; treat as active, persistent threat

    - Rotate all credentials on affected systems

    - Conduct forensic analysis to identify lateral movement extent

    - Block identified C&C infrastructure across all network segments


    ---


    ## HackWire Analysis


    Armored Likho represents a concerning convergence of criminal and state-sponsored tradecraft. The group's hybrid operational model—simultaneously running financially motivated attacks against individuals while targeting critical infrastructure—suggests either a criminal organization with state connections or a nation-state actor conducting both sponsored and self-funded operations for additional revenue.


    What makes Armored Likho particularly significant isn't just capability, but intent multiplicity. Most APT actors optimize for either espionage or financial gain. Armored Likho appears to be doing both simultaneously, using identical infrastructure and malware for victims ranging from individual cryptocurrency holders to government agencies. This operational flexibility implies either organizational diversity (multiple teams, same management) or an actor sufficiently mature to compartmentalize operations efficiently.


    The use of GitHub repositories for malware delivery deserves particular attention. While security researchers have documented malware distribution through legitimate platforms before, Armored Likho's approach appears deliberate: hosting what appear to be genuine development builds allows for initial-access detection avoidance while enabling rapid malware updates through seemingly legitimate software repository activity. This is sophistication born not from advanced technology, but from understanding defender blind spots.


    For defenders, the immediate priority should be threat hunting rather than waiting for endpoint detection tools to alert. Organizations running Python 3.12 on non-development systems, or showing unusual GitHub repository downloads, should assume compromise and conduct forensic investigation. The group's apparent capability for long-term persistence before exfiltration suggests many compromises remain undetected.


    The regional focus—Russia, Brazil, Kazakhstan—may suggest future expansion into other geographic areas, or these may be honeypots in an intelligence operation targeting specific adversaries within these countries. Either way, organizations in regions that border or engage in technical competition with these countries should assume this threat actor may soon have them in scope.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)