Malware Armored Likho APT leverages AI-generated malware and BusySnake Stealer July 9, 2026 Share By SC Staff (Adobe Stock) A previously unknown advanced persistent threat group, dubbed Armored Likho, is employing AI-generated malware, sophisticated phishing techniques, and the BusySnake Stealer to target government agencies and electric power organizations across Russia, Kazakhstan, and Brazil, Kaspersky reports. This dual-pronged approach, targeting both private individuals for financial gain and critical infrastructure for espionage, is an unusual strategy for cyber threat actors, according to a recent report by Security Affairs. Armored Likho utilizes a modular and evolving toolkit that includes obfuscated remote access trojans (RATs), the Python-based BusySnake Stealer, and Go2Tunnel for network tunneling. The attack chain commences with spear-phishing emails containing lures ranging from official government notices to humanitarian aid applications. These emails deliver either self-extracting archives that deploy a loader into legitimate processes or LNK shortcut files exploiting a known vulnerability to execute PowerShell scripts. Both infection vectors ultimately lead to the deployment of BusySnake Stealer, which is designed to exfiltrate credentials, cryptocurrency keys, API secrets, and sensitive documents. The stealer also harvests Telegram session data and RustDesk credentials, and establishes reverse SSH tunnels for operator access. The use of AI in generating initial payloads allows the group to rapidly vary their tactics, techniques, and procedures (TTPs), complicating attribution and making each campaign appear structurally distinct. Kaspersky attributes this campaign to Armored Likho with medium confidence due to structural overlaps with previous malware families used by the group, such as AquilaRAT. The campaign remains active, with confirmed victims in Russia, Kazakhstan, and Brazil, focusing on government and electric power infrastructure. Source: Security Affairs SC Staff Related Malware Attackers use Microsoft Teams voice calls to deliver EtherRAT malware SC Staff July 7, 2026 The campaign, detailed by Palo Alto Networks' Unit 42, begins with a phishing email containing a malicious PDF. Malware New QuimaRAT malware targets Windows, Linux, and macOS via MaaS model SC Staff July 7, 2026 QuimaRAT features a modular architecture, allowing for dynamic expansion of capabilities through encrypted plugins delivered via its command-and-control (C2) infrastructure. Malware New ChocoPoC trojan targets security researchers with fake exploit code SC Staff July 2, 2026 ChocoPoC operates by hiding its malicious payload within a Python package that is pulled in as a dependency by the seemingly harmless PoC code. Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Adware You can skip this ad in 5 seconds