[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fX7w3QeFoaCc0vs-Fw7JrrRsnDC1pnlu6swzaSWD0Ws4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":58},"185a7dbf-a046-4e88-8d61-e59c3cc4ca13","apt-group-armored-likho-uses-ai-crafted-spear-phishing-and-python-stealer-to-harvest-credentials","943a6276-8779-436c-b030-11c38ba1a41b","APT Group Armored Likho Uses AI-Crafted Spear-Phishing and Python Stealer to Harvest Credentials","Armored Likho is a sophisticated APT group leveraging AI-generated spear-phishing lures to deliver BusySnake Stealer, a Python-based infostealer targeting browser credentials and session cookies. The use of AI to craft convincing phishing content significantly lowers the barrier for bypassing human detection, making traditional security awareness training insufficient on its own. Stolen credentials and cookies can enable persistent, stealthy access to sensitive government and critical infrastructure systems without triggering password-based alerts. The group's use of Go2Tunnel for covert network tunneling further complicates detection, as legitimate-looking traffic masks lateral movement. This campaign highlights the growing risk of AI-augmented social engineering combined with custom malware designed to evade modern security solutions.","**Immediate actions:**\n- Deploy advanced email filtering with AI-based phishing detection to flag spear-phishing attempts before they reach end users.\n- Enforce browser credential isolation policies and disable persistent cookie storage for sensitive applications to reduce the value of stolen data.\n- Block unauthorized tunneling tools (e.g., Go2Tunnel) at the perimeter firewall and enforce application allowlisting on endpoints.\n\n**Long-term improvements:**\n- Implement phishing-resistant MFA (e.g., FIDO2\u002Fpasskeys) across all government and critical infrastructure accounts to neutralize stolen credential attacks.\n- Conduct regular, scenario-based security awareness training that specifically addresses AI-generated phishing content and spear-phishing tactics.\n- Enforce least-privilege access controls and segment networks so that compromised endpoints cannot be used for lateral movement into critical systems.\n\n**Detection measures:**\n- Deploy EDR\u002FXDR solutions capable of detecting Python-based malware execution and anomalous browser data access patterns.\n- Monitor for unauthorized network tunneling activity and unusual outbound connections indicative of command-and-control communication.\n- Establish a threat intelligence feed subscription to track Armored Likho TTPs and update detection rules accordingly.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 SI-3 (Malicious Code Protection)","NIST SP 800-53 AC-17 (Remote Access)","NIST SP 800-53 IA-5 (Authenticator Management)","NIST SP 800-53 SC-7 (Boundary Protection)","MITRE ATT&CK T1566.001 – Spearphishing Attachment","MITRE ATT&CK T1539 – Steal Web Session Cookie","MITRE ATT&CK T1572 – Protocol Tunneling","GDPR Article 32 – Security of Processing","NIST CSF DE.CM-1 – Network Monitoring",{},"published","2026-07-03T12:21:36.596838+00:00","2026-07-03T12:21:36.265+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fsecurelist.com\u002Ftr\u002Farmored-likho-apt-with-busysnake-stealer\u002F120292\u002F","armored-likho-digging-a-snake-pit-inside-the-covert-busysnake-stealer-campaign-6af4e2","Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":40,"name":41,"slug":42,"description":43,"color":44},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":46,"name":47,"slug":48,"description":49,"color":50},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[52],{"id":53,"date":54,"edition":55,"title":56,"audio_url":57},"d09580d0-cd7a-4b68-9170-5fa41174a07d","2026-07-03","afternoon","ThreatNoir Afternoon Brief — July 3","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-07-03\u002Fthreatnoir-afternoon-brief-2026-07-03.mp3",[59,63,67],{"slug":60,"name":61,"problem":62},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":64,"name":65,"problem":66},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":68,"name":69,"problem":70},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]