Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign
Armored Likho APT uses AI-generated loaders and BusySnake Stealer against Russia, Brazil, and Kazakhstan.
A new APT group, Armored Likho, is conducting covert campaigns targeting government and electric power sectors in Russia, Brazil, and Kazakhstan. They employ spear-phishing with AI-generated loaders and a new Python-based infostealer called BusySnake Stealer, which targets credentials and cookies from browsers. The group also uses tools like Go2Tunnel for network tunneling and exhibits evolving tactics to evade security solutions.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Go2Tunnel?
Get an email when a new story names Go2Tunnel, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonArmored Likho is a sophisticated APT group leveraging AI-generated spear-phishing lures to deliver BusySnake Stealer, a Python-based infostealer targeting browser credentials and session cookies. The use of AI to craft convincing phishing content significantly lowers the barrier for bypassing human detection, making traditional security awareness training insufficient on its own. Stolen credentials and cookies can enable persistent, stealthy access to sensitive government and critical infrastructure systems without triggering password-based alerts. The group's use of Go2Tunnel for covert network tunneling further complicates detection, as legitimate-looking traffic masks lateral movement. This campaign highlights the growing risk of AI-augmented social engineering combined with custom malware designed to evade modern security solutions.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — BusySnake Stealer
- malware — Go2Tunnel