Armored Likho is a recently discovered APT actor that targets government and electric power sectors in Russia, Brazil, and Kazakhstan. It uses spear-phishing to deliver modular malware, including RATs and information stealers like the Python-based BusySnake Stealer. This malware performs a wide range of functions, such as credential harvesting from browsers and Telegram, clipboard theft, screenshot capture, and establishing reverse SSH tunnels for persistent access. The malware dynamically decrypts and encrypts its bytecode to evade detection and runs stealthily without a console window. Armored Likho’s operations include both financially motivated attacks and cyber espionage. The group’s toolkit and tactics show overlap with the Eagle Werewolf APT, which used similar RATs. The threat actor fetches malware components from GitHub repositories, including early development builds, indicating ongoing tool evolution.

The threat actor can maintain stealthy, persistent control over compromised hosts, enabling exfiltration of sensitive credentials, browser data, OTP keys, cryptocurrency wallets, and Telegram sessions. This access facilitates espionage against targeted organizations and financially motivated theft from individuals. The malware’s capabilities to capture screenshots, log keystrokes, and execute commands remotely increase the risk of data breaches and operational disruption in critical sectors such as government and electric power. The use of modular malware allows tailored attacks, increasing the effectiveness and stealth of the campaigns.

No official patch or remediation is applicable as this is a threat actor’s campaign rather than a software vulnerability. Organizations should focus on user awareness to reduce spear-phishing success, implement email filtering to block malicious attachments, and employ endpoint detection and response (EDR) solutions capable of detecting modular RATs and information stealers. Monitoring for unusual network activity, such as reverse SSH tunnels or connections to suspicious GitHub repositories, may help identify compromises. Since the threat actor uses evolving malware, continuous threat intelligence updates and behavioral detection are recommended.