[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQUS9BgGcF4ESbztwr_WcIORa_F5PFFL67WVE4rqVxM8":3},{"article":4,"iocs":51,"watch_terms":57,"solutions":58,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"943a6276-8779-436c-b030-11c38ba1a41b","Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign","armored-likho-digging-a-snake-pit-inside-the-covert-busysnake-stealer-campaign-6af4e2","An inside look at the active Armored Likho APT campaign. The attackers are using spear-phishing, AI-generated loaders, and a new Python-based tool, BusySnake Stealer, to target organizations in Russia, Kazakhstan, and Brazil.","A new APT group, Armored Likho, is conducting covert campaigns targeting government and electric power sectors in Russia, Brazil, and Kazakhstan. They employ spear-phishing with AI-generated loaders and a new Python-based infostealer called BusySnake Stealer, which targets credentials and cookies from browsers. The group also uses tools like Go2Tunnel for network tunneling and exhibits evolving tactics to evade security solutions.","Armored Likho APT uses AI-generated loaders and BusySnake Stealer against Russia, Brazil, and Kazakhstan.","https:\u002F\u002Fsecurelist.com\u002Ftr\u002Farmored-likho-apt-with-busysnake-stealer\u002F120292\u002F","https:\u002F\u002Fmedia.kasperskycontenthub.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F43\u002F2026\u002F06\u002F30105924\u002Farmored-likho-busysnake-featured-image-scaled-1.jpg","2026-07-03T10:00:33+00:00","2026-07-03T12:00:21.523568+00:00",9,[17,20,23,26],{"name":18,"type":19},"Armored Likho","threat_actor",{"name":21,"type":22},"Go2Tunnel","product",{"name":24,"type":25},"Python","technology",{"name":27,"type":25},"AI","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":28,"icon":30,"name":31,"slug":32},null,"Threat Intelligence","threat-intelligence",[34,39,44,49],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":28,"icon":30,"name":31,"slug":32},[52,55],{"type":48,"value":53,"context":54},"BusySnake Stealer","Python-based infostealer used by Armored Likho APT.",{"type":48,"value":21,"context":56},"Tool used for remote access and network tunneling by Armored Likho APT.",[21],{"controls":59,"vendors":144},[60,89,118],{"slug":61,"name":62,"problem":63,"products":64},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":90,"name":91,"problem":92,"products":93},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":119,"name":120,"problem":121,"products":122},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[123,131,136],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":132,"product_name":133,"url":134,"description":135},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",[],{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":162},"apt-group-armored-likho-uses-ai-crafted-spear-phishing-and-python-stealer-to-harvest-credentials","APT Group Armored Likho Uses AI-Crafted Spear-Phishing and Python Stealer to Harvest Credentials","Armored Likho is a sophisticated APT group leveraging AI-generated spear-phishing lures to deliver BusySnake Stealer, a Python-based infostealer targeting browser credentials and session cookies. The use of AI to craft convincing phishing content significantly lowers the barrier for bypassing human detection, making traditional security awareness training insufficient on its own. Stolen credentials and cookies can enable persistent, stealthy access to sensitive government and critical infrastructure systems without triggering password-based alerts. The group's use of Go2Tunnel for covert network tunneling further complicates detection, as legitimate-looking traffic masks lateral movement. This campaign highlights the growing risk of AI-augmented social engineering combined with custom malware designed to evade modern security solutions.",[150,151,152,153,154,155,156,157,158,159,160,161],"CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 SI-3 (Malicious Code Protection)","NIST SP 800-53 AC-17 (Remote Access)","NIST SP 800-53 IA-5 (Authenticator Management)","NIST SP 800-53 SC-7 (Boundary Protection)","MITRE ATT&CK T1566.001 – Spearphishing Attachment","MITRE ATT&CK T1539 – Steal Web Session Cookie","MITRE ATT&CK T1572 – Protocol Tunneling","GDPR Article 32 – Security of Processing","NIST CSF DE.CM-1 – Network Monitoring",{}]