Kaspersky identified a cybercriminal group named Armored Likho that compromised government agencies and electrical power entities in Russia, Brazil, and Kazakhstan. The group launches attacks using spear-phishing emails and employs a new Python-based infostealer dubbed BusySnake Stealer.

Armored Likho's spear-phishing campaigns involve emails disguised as official government or social assistance communications. These emails contain archive files with malicious executables or Windows shortcut files, luring targets with documents such as psychological tests, humanitarian aid applications, or debt clearance certificates. The first-stage payload then initiates a decoy application or document while deploying additional malware in the background.

Kaspersky observed a trend of using AI tools to generate initial payloads, with coding style and embedded comments in loader components indicating the use of large language models. "An analysis of Armored Likho's campaigns over the past few months shows a trend toward using AI tools to generate first-stage payloads, as indicated by redundant comments and code blocks," Kaspersky said. These loaders fetch archives from GitHub repositories containing early development builds and test samples of the malware.

The BusySnake Stealer is designed to harvest browser-stored passwords, cookies, clipboard contents, cryptographic keys, and messaging and authentication data, including Telegram session information. It can also establish reverse SSH tunnels, deploy remote-access software for persistent interactive access, and supports a command-and-control channel for additional commands. Armored Likho utilizes the commercial code obfuscation tool PyArmor Pro to encrypt BusySnake's Python bytecode, decrypting functions only when needed and re-encrypting them immediately after use. BusySnake operates silently without opening a console window and uses a lock-file mechanism to prevent multiple copies from executing simultaneously. It can capture screenshots on command, exfiltrate logged keystroke data, decrypt stored passwords from Chromium-based and Firefox browsers, scrape machines for OTP keys, find cryptocurrency wallets, and restart RustDesk to capture user credentials. BusySnake also filters the files it scans and exfiltrates, and embeds many networking functions directly into its code instead of relying on external tools.

Kaspersky stated that Armored Likho's malware stack includes modular remote access trojans and tools like Go2Tunnel for remote access and network tunneling. The security vendor has not identified Armored Likho as being affiliated with any specific nation and provided indicators of compromise to help organizations detect and block Armored Likho activity.

Why It Matters

The activity of Armored Likho demonstrates the evolution of cybercriminal operations, including the use of artificial intelligence in developing malware and the deployment of sophisticated infostealers. The group's targeting of government and energy sectors in multiple countries, combined with its financially motivated campaigns and cyber-espionage activities against organizations and individuals, indicates a broad scope of operations.

The technical characteristics of BusySnake Stealer, such as its advanced obfuscation, direct embedding of networking functions, and capabilities for data exfiltration and persistent access, highlight the increasing complexity of cyber threats. Kaspersky's provision of indicators of compromise offers a measure for organizations to safeguard against these evolving threats.