Armored Likho's new weapon: BusySnake Stealer

The threat involves a previously undocumented Python-based infostealer named BusySnake Stealer deployed by the APT group Armored Likho. The campaign uses spear-phishing emails targeting government and electric power sectors in Russia, Brazil, and Kazakhstan. BusySnake Stealer employs PyArmor Pro for obfuscation, extracts credentials from browsers using DPAPI and NSS libraries, captures screenshots, logs keystrokes, scrapes cryptocurrency wallets and 2FA tokens, and establishes reverse SSH tunnels for remote access. The malware uses AI-generated code for initial payloads and distributes components via GitHub. Persistence is achieved through scheduled tasks, and the malware communicates with C2 infrastructure to receive commands dynamically. This campaign marks a significant advancement in the group's technical sophistication.

The malware can steal sensitive credentials from browsers, capture user activity through screenshots and keystrokes, extract cryptocurrency wallets and two-factor authentication tokens, and provide remote access via reverse SSH tunnels. This can lead to unauthorized access to targeted systems, data theft, and potential disruption of critical infrastructure in the electric power sector and government agencies in the affected countries.

No official patch or remediation is available as this is malware deployed via spear-phishing. Organizations should focus on user awareness training to recognize phishing attempts, implement email filtering to block malicious attachments, and employ endpoint detection and response solutions to detect and block BusySnake Stealer behaviors. Monitoring for scheduled tasks that establish persistence and network connections indicative of reverse SSH tunnels may help detect infections. Since this is a targeted campaign, organizations in the affected sectors and countries should apply heightened vigilance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.