Malware News Kaspersky identifies APT group Armored Likho deploying BusySnake Stealer, a new Python-based infostealer hitting government and electric power targets

[Khushal]

Content source

https://securelist.com/tr/armored-likho-apt-with-busysnake-stealer/120292/

APT group Armored Likho deploys BusySnake Stealer, a new Python-based infostealer hitting government and electric power targets across Russia , Kazakhstan , and Brazil , with LLM-generated loaders complicating attribution.

- Initial access uses spear-phishing archives (ZIPs/RARs with names like "psihologicheskiy_test.zip" or "zayavka_gumanitarnayapomosch.rar") dropping either NSIS-based EXE droppers or LNK files exploiting ZDI-CAN-25373 to hide PowerShell commands. Both chains stage into AppData\WindowsHelper, drop a Python 3.12 runtime, and persist via a scheduled task named WindowsHelper firing every 5 minutes. First-stage loaders contain verbose comments and emoji, strongly indicating LLM generation (T1566.001, T1059.001, T1053.005).

- BusySnake Stealer (module.pyw, protected by PyArmor Pro 9.2.0) harvests clipboard data, enumerates files for 64-char hex keys, exfiltrates Desktop/Documents/Downloads files under 5 MB, steals Chromium passwords via DPAPI, decrypts Firefox credentials via PK11SDR_Decrypt without master password re-auth, and grabs Telegram tdata by force-killing telegram.exe. It also deploys a browser extension for cookie theft and establishes reverse SSH tunnels using keys from C2.

Armored Likho's new weapon: BusySnake Stealer

An inside look at the active Armored Likho APT campaign. The attackers are using spear-phishing, AI-generated loaders, and a new Python-based tool, BusySnake Stealer, to target organizations in Russia, Kazakhstan, and Brazil.

securelist.com

 

[Bot]

Technical Highlights

This campaign combines several notable techniques worth flagging for defenders monitoring similar infrastructure:

• ZDI-CAN-25373 abuse in LNK files to conceal PowerShell execution is a technique that has been seen in multiple APT campaigns recently, since it allows command content to be hidden from casual inspection of the shortcut properties.
• The persistence mechanism (scheduled task "WindowsHelper" firing every 5 minutes, staged under AppData\WindowsHelper) is a fairly distinctive artifact that should be easy to hunt for in endpoint telemetry or EDR queries.
• The use of PyArmor Pro 9.2.0 to protect module.pyw indicates an attempt to hinder static analysis and signature-based detection, which is consistent with other Python-based stealers seen protecting payloads against reverse engineering.
• Credential theft methods described (DPAPI for Chromium, PK11SDR_Decrypt for Firefox without master password prompt, and killing telegram.exe to access tdata) are established techniques, not novel, but the combination in a single Python payload is efficient for the attacker.
• The mention of "LLM-generated loaders" based on verbose comments/emoji in the first-stage code is an interesting attribution note, though this should be treated as a stylistic observation rather than definitive proof of authorship methodology.

Detection and Hunting Suggestions

• Look for scheduled tasks named "WindowsHelper" or similarly generic Windows-sounding names created outside normal software installations.
• Check for unexpected Python 3.12 runtimes dropped into AppData paths, especially alongside .pyw files.
• Monitor for LNK files with unusual properties or PowerShell spawned from Explorer.exe via shortcut execution (T1059.001).
• Flag archives with social-engineering-themed names (psychological tests, humanitarian aid applications) arriving via spear-phishing, particularly targeting government or energy sector employees.
• Watch for outbound SSH tunnel connections initiated from endpoints that should not normally establish such connections, since reverse SSH tunneling is mentioned as part of the C2 mechanism.

General Recommendations

Organizations in the sectors mentioned (government, electric power) should treat this as a reminder to restrict script execution policies, disable or tightly control LNK file execution from removable/email sources where feasible, and ensure browser credential stores are protected with additional layers (hardware-backed encryption, password manager with MFA) rather than relying solely on OS-level protections like DPAPI.

As always, samples related to this campaign should be submitted to VirusTotal or analyzed in a sandbox before drawing conclusions on any specific file, and detection coverage should be validated against the IOCs published in the Securelist report rather than assumed.

Sources

• Armored Likho's new weapon: BusySnake Stealer