Armored Likho: New APT Group Targets Global Energy and Government Sectors with BusySnake Stealer

Executive Summary

Researchers from Kaspersky have identified a newly discovered advanced persistent threat (APT) group named Armored Likho. This group is conducting targeted campaigns against government entities and the electric power industry, with observed activity in Russia, Brazil, and Kazakhstan. Armored Likho's operations are a hybrid of cyber-espionage and financially motivated attacks. The group employs a custom toolkit that includes a new Python-based information stealer called BusySnake Stealer, as well as other modular RATs and tools. There is evidence suggesting the use of AI in generating some of their payloads, and a potential operational overlap with another threat cluster known as "Eagle Werewolf."

Threat Overview

Armored Likho represents a sophisticated and evolving threat. Their campaigns are characterized by targeted social engineering and the use of custom malware designed for stealth and persistence.

• Initial Access: The primary vector is spear-phishing emails tailored to their targets, often disguised as official government notices. These emails contain malicious RAR archives with droppers. (T1566.001 - Spearphishing Attachment).
• Payload Delivery: The initial droppers retrieve second-stage payloads from public GitHub repositories, a common technique to blend in with legitimate developer traffic (T1105 - Ingress Tool Transfer).
• Malware Arsenal: The group's main tool is the BusySnake Stealer, a modular Python-based infostealer. It is capable of establishing persistence, exfiltrating user documents, capturing screenshots, and stealing data from the system clipboard and browser cookies. They also utilize tools like Go2Tunnel for creating covert SSH tunnels for C2 communications.
• Targets: The group has a clear focus on high-value targets, including government agencies and the electric power sector, indicating espionage as a primary motive. Other targets include defense organizations involved in UAV manufacturing.

Technical Analysis

Armored Likho's TTPs demonstrate a focus on evasion and data theft.

• Defense Evasion: The malware is described as highly obfuscated and modular, designed to bypass dynamic analysis. This aligns with techniques like T1027 - Obfuscated Files or Information and T1140 - Deobfuscate/Decode Files or Information. The use of AI to generate code could be a method to create unique, non-signatured payloads for each target.
• Collection: The BusySnake Stealer performs extensive data collection, including T1113 - Screen Capture, T1005 - Data from Local System, and T1115 - Clipboard Data.
• Command and Control: The use of Go2Tunnel for SSH tunneling is an example of T1572 - Protocol Tunneling to hide C2 traffic within an encrypted channel.
• Persistence: The stealer establishes persistence to ensure long-term access, likely using common methods like T1547.001 - Registry Run Keys / Startup Folder.

Impact Assessment

The targeting of government and energy sectors by a sophisticated APT group like Armored Likho poses a significant national security risk. A successful compromise could lead to:

• Espionage: Theft of sensitive government documents, state secrets, or intellectual property related to defense and energy infrastructure.
• Infrastructure Disruption: In the energy sector, a compromise could move from data theft to operational disruption, potentially impacting the power grid.
• Financial Loss: The financially motivated component of their attacks could lead to direct theft or extortion. The group's continuous development of its toolkit and potential use of AI suggests they are a persistent and adaptable adversary capable of causing significant damage.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) such as IP addresses, domains, or file hashes were mentioned in the source articles.

Cyber Observables — Hunting Hints

Security teams should hunt for signs of stealthy Python malware and unusual data exfiltration. The following patterns could indicate related activity:

Detection & Response

1. Script Block Logging: Enable and ingest PowerShell and Python script block logging. This provides visibility into the commands executed by malware like BusySnake, even if the script itself is obfuscated. This is a form of D3FEND's Process Analysis (D3-PA).
2. Network Traffic Analysis: Decrypt and analyze network traffic where possible. Monitor for protocol tunneling (e.g., SSH over non-standard ports) and connections to known malicious or suspicious domains, including GitHub repositories used for C2. This aligns with Network Traffic Analysis (D3-NTA).
3. Email Security: Use email security gateways with sandboxing capabilities to analyze attachments like RAR archives and detect malicious droppers before they reach the user.

Mitigation

1. User Training: Train users to be suspicious of unsolicited emails, especially those with attachments that claim to be official notices. This is a key part of User Training (M1017).
2. Application Control: Use application control policies to restrict the execution of scripting languages like Python from user-writable directories. This aligns with Executable Denylisting (D3-EDL).
3. Egress Filtering: Block or restrict outbound traffic for protocols like SSH from general user workstations, allowing it only from authorized administrative jump boxes. This is a form of Outbound Traffic Filtering (D3-OTF).
4. Endpoint Hardening: Harden endpoints by disabling unused services and enforcing the principle of least privilege to limit the impact of a successful compromise.