{"schema_version":"0.10.0","id":"LR-2026-0622","record_version":1,"title":"Armored Likho APT campaign hitting power and government networks with BusySnake Stealer","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":44.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":3.84,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Tech Times · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: Tech Times · subject to change"}]},"sources_hash":"c6fc51b75104206b2a0a9f70fb280068f8c56ee2fbe1dd9832e8c148091d795e"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-07-04","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Kaspersky publicly named a previously undocumented threat actor, Armored Likho, behind an ongoing cyber-espionage campaign against government agencies and electric power operators in Russia, Kazakhstan and Brazil. The campaign delivers BusySnake Stealer, a Python infostealer that harvests browser passwords, session cookies, OTP-related clipboard content and Telegram session data, and can open reverse SSH tunnels. Victims are reached through spear-phishing emails carrying malicious archives or shortcut files, and one chain uses CVE-2025-9491. Kaspersky found evidence that the group used large language models to generate its first-stage loader code. Microsoft fixed that flaw in its November 2025 Patch Tuesday update, and systems without the update remain vulnerable. Kaspersky describes the campaign as still active at the time of publication.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":"third_party","adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK04","secondary_risks":["RK07"]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Test applied: live production compromise. Fact: the campaign against government and power-sector networks is described as still active at publication; no victim count or loss figure is stated.","harm_class":[],"affected_description":"Government agencies and electric power operators across Russia, Kazakhstan, and Brazil","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.techtimes.com/articles/319680/20260704/new-apt-group-hits-power-grids-three-countries-ai-crafted-malware.htm","publisher":"Tech Times","date":"2026-07-04","type":"press","title":"New APT Group Hits Power Grids in Three Countries with AI-Crafted Malware - Tech Times","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"event.incident_class":"C","event.responsible_party":"C","event.adversarial_actor":"C","impact.affected_description":"C","context.industry":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"Kaspersky has publicly named a previously undocumented threat actor — Armored Likho — behind an ongoing cyber-espionage campaign hitting government agencies and electric power operators across Russia, Kazakhstan, and Brazil."}],"event.responsible_party":[{"source_index":0,"quote":"Kaspersky has publicly named a previously undocumented threat actor — Armored Likho — behind an ongoing cyber-espionage campaign hitting government agencies and electric power operators across Russia, Kazakhstan, and Brazil."}],"event.adversarial_actor":[{"source_index":0,"quote":"Armored Likho reaches its victims through spear-phishing emails calibrated to each target environment, with lures ranging from official government notices to humanitarian aid applications."}],"impact.affected_description":[{"source_index":0,"quote":"Kaspersky has publicly named a previously undocumented threat actor — Armored Likho — behind an ongoing cyber-espionage campaign hitting government agencies and electric power operators across Russia, Kazakhstan, and Brazil."}],"context.industry":[{"source_index":0,"quote":"Kaspersky has publicly named a previously undocumented threat actor — Armored Likho — behind an ongoing cyber-espionage campaign hitting government agencies and electric power operators across Russia, Kazakhstan, and Brazil."}],"impact.severity":[{"source_index":0,"quote":"Kaspersky describes the campaign as still active at the time of publication."}],"impact.severity_because":[{"source_index":0,"quote":"Kaspersky describes the campaign as still active at the time of publication."}],"event.summary":[{"source_index":0,"quote":"Kaspersky has publicly named a previously undocumented threat actor — Armored Likho — behind an ongoing cyber-espionage campaign hitting government agencies and electric power operators across Russia, Kazakhstan, and Brazil."},{"source_index":0,"quote":"Telegram session data is collected by force-terminating the Telegram process, compressing its entire tdata session directory, and uploading the archive — effectively hijacking the victim's Telegram identity."},{"source_index":0,"quote":"For 2FA secrets, the stealer monitors the clipboard for strings matching the otpauth:// pattern — the format used by Google Authenticator, Authy, and similar apps when keys are shared or backed up."},{"source_index":0,"quote":"In the first chain, a malicious archive contains an executable dropper built with the Nullsoft Scriptable Install System (NSIS)."},{"source_index":0,"quote":"The second chain uses Windows shortcut (.lnk) files and exploits CVE-2025-9491, also known as ZDI-CAN-25373."},{"source_index":0,"quote":"When the C2 server sends a tunnel command, BusySnake contacts grked[.]online to receive a dynamically issued private SSH key and a pre-constructed SSH command specifying the attacker's server, port, and tunnel parameters."},{"source_index":0,"quote":"Among the more operationally significant findings in the Kaspersky report is evidence that Armored Likho is using large language models to generate its first-stage loader code."},{"source_index":0,"quote":"Microsoft silently addressed the flaw in its November 2025 Patch Tuesday update by forcing the Properties dialog to display the full command string."},{"source_index":0,"quote":"The fix matters because systems that have not received that update remain vulnerable."},{"source_index":0,"quote":"Kaspersky describes the campaign as still active at the time of publication."}]},"notes_on_gaps":"The sources describe a human-run APT campaign and malware; the LLM was used to write loader code, not as a deployed autonomous agent, so no system.* AI model fields, agent_involved, or failure_class are recorded. No date of occurrence, date of detection, trigger, detection method, victim count, loss, or records exposed is stated. The 'Thursday' disclosure day is not converted to a date; date_disclosed uses the FAQ's stated month July 2026. Eagle Werewolf overlap is described by the source as substantial but not confirmed, and the attribution is medium confidence per Kaspersky. Country-level context is multiple countries, so context.country is left out. Severity 'major' is my judgement under the live production compromise test, since the source gives no stated count of affected parties. The FAQ mentions cryptocurrency wallet scanning and the Russian Market, which do not appear in the body and were not used. Only a press article was supplied; the Kaspersky primary report was not read. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: Tech Times · subject to change)]"},"context":{"industry":"Government and electric power","org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"analysis":{"sections":{"timeline":[{"text":"CVE-2025-9491 is disclosed publicly by Trend Micro's Zero Day Initiative.","quote":"This vulnerability — disclosed publicly by Trend Micro's Zero Day Initiative in March 2025 after Microsoft initially declined to patch it — allows attackers to hide malicious command-line arguments inside a shortcut file using whitespace padding, so that inspecting the file in Windows shows only an innocuous-looking target.","source_index":0,"when":"March 2025"},{"text":"Microsoft addresses CVE-2025-9491 in its Patch Tuesday update.","quote":"Microsoft silently addressed the flaw in its November 2025 Patch Tuesday update by forcing the Properties dialog to display the full command string.","source_index":0,"when":"November 2025"},{"text":"Eagle Werewolf compromises a drone-focused Telegram channel to distribute AquilaRAT.","quote":"In February 2026, Eagle Werewolf was observed compromising a drone-focused Telegram channel to distribute a malware family called AquilaRAT, delivered via a Rust-language dropper disguised as a checklist for Starlink device activation.","source_index":0,"when":"February 2026"},{"text":"Kaspersky first documents BusySnake Stealer and publicly names Armored Likho.","quote":"BusySnake Stealer is a Python-based infostealer first documented by Kaspersky in July 2026.","source_index":0,"when":"2026-07"},{"text":"The campaign is described as still active at publication.","quote":"Kaspersky describes the campaign as still active at the time of publication.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.techtimes.com/articles/319680/20260704/new-apt-group-hits-power-grids-three-countries-ai-crafted-malware.htm"]}}