Kaspersky researchers have published technical analysis of an active campaign by Armored Likho, a Russia-attributed threat actor also tracked as Eagle Werewolf, targeting government agencies and electric power sector organisations across Russia, Kazakhstan, and Brazil. The campaign deploys BusySnake, a Python-based infostealer with credential harvesting capabilities across browsers, messaging platforms, remote desktop tools, and cryptocurrency wallets. A second-generation variant now executes entirely in-memory, eliminating disk artifacts that endpoint detection tools typically rely on.
Threat Actor and Infrastructure
Armored Likho overlaps with Awaken Likho, also known as Core Werewolf, based on shared tooling: the Go2Tunnel reverse SSH proxy and AquilaRAT loader appear across both clusters. The actor uses spear-phishing as its primary access vector, deploying NSIS-packaged executable droppers and LNK shortcut files that exploit ZDI-CAN-25373, a vulnerability in Windows file handling that executes embedded payloads when a shortcut is opened.
The campaign’s command and control infrastructure spans six domains including winupdate[.]live, arvax[.]xyz, varenie[.]live, and grked[.]online, resolving to four IP addresses in the 159.198.0.0/16 and 69.67.173.0/24 ranges. Reverse SSH tunneling through grked[.]online/tunnel/create/ provides resilient C2 connectivity through firewalls and NAT boundaries. The loaders deploying BusySnake show markers consistent with AI-assisted code generation: verbose inline comments and bullet-point emoji characters embedded in comment blocks, a pattern increasingly documented in threat actor tooling.
BusySnake Capabilities
BusySnake is protected with PyArmor Pro 9.2.0 and implements a structured task management system with four execution states: SCHEDULED, IN_PROGRESS, SUCCEEDED, and FAILED. This architecture allows the C2 to queue and track multiple simultaneous collection tasks per victim.
Credential harvesting covers the major browser families. Firefox credentials are extracted by calling PK11SDR_Decrypt() against the NSS credential store. Chromium-family credentials are recovered through Windows DPAPI decryption against the logins SQLite database. Beyond browsers, BusySnake targets Telegram session files from the /tdata directory, RustDesk remote desktop credentials, clipboard content, and cryptocurrency wallet private keys identified by 64-character hexadecimal pattern matching. Screenshots are captured on demand.
Persistence in the original variant is established through a VBScript file (run.vbs) registered as a scheduled task executing every five minutes. Newer campaign infrastructure uses COM-based scheduled task registration, which is harder to detect through standard scheduled task enumeration tooling.
The second-generation BusySnake variant removes file-based execution entirely. Python scripts are transmitted from the C2, executed in-memory, and discarded without touching disk. This architecture defeats file hash detection and many behaviour-based rules that trigger on script file creation.
What This Means for Affected Sectors
The targeting profile is specific. Government agencies in the three identified countries represent access to sensitive administrative data and inter-agency communications. Electric power sector organisations present a different risk profile: operational credentials obtained through BusySnake could enable follow-on access to OT-adjacent systems, SCADA historian interfaces, or remote access platforms used by maintenance personnel.
The Telegram session harvesting capability is notable for both sectors. Government and infrastructure personnel frequently use Telegram for operational communications in the CIS region. Session file theft provides access to historical messages and ongoing conversations without requiring the account password or triggering MFA challenges.
Recommended Actions
Organisations in the targeted sectors should review endpoint telemetry for the identified C2 domains and IP ranges and block them at the network perimeter. Scrutinise incoming LNK files in email and file shares; the ZDI-CAN-25373 exploitation path requires user interaction with a shortcut file. Audit scheduled tasks for entries created by COM registration rather than standard Task Scheduler interfaces.
For browser credential exposure, enforce enterprise credential management that stores credentials outside the browser profile directories BusySnake targets. Where Telegram is used for operational communications, review whether web session-based access is enabled on devices that could be compromised.
Indicators of compromise from the Securelist report should be ingested into SIEM and EDR platforms immediately.