Armored Likho Targets Government Agencies, Power Sector with Busy Snake Stealer
Summary: Kaspersky attributed attacks on government agencies and the electric power sector in Russia, Brazil, and Kazakhstan to a previously undocumented actor it calls Armored Likho, which uses obfuscated modular RATs and infostealers built to bypass dynamic analysis. The chain begins with spear-phishing emails using government-notice or social-program lures that deliver a RAR archive with EXE droppers pulling payloads from a GitHub repository, including a new Python-based stealer named BusySnake, while alternate chains exploit the now-patched Windows shortcut flaw CVE-2025-9491, fixed in Microsoft's November 2025 Patch Tuesday updates.
What's compelling: Trend Micro found CVE-2025-9491 was weaponized by a dozen hacking groups since 2017, and BusySnake's C2 commands can screenshot at set intervals, log keystrokes, harvest Telegram sessions and cryptocurrency wallet files, and pull browser cookies and passwords. Kaspersky also reports signs that the first-stage loaders and stagers were likely generated with AI assistance, and that Go2Tunnel's reverse-tunneling capability is now built directly into the stealer rather than run as a separate utility.
Read the original at The Hacker News ↗
- Topics
- Malware
- Mentions
- CVE-2025-9491
- Related