Cases › security breach › LR-2026-0622
Armored Likho APT campaign hitting power and government networks with BusySnake Stealer
Preliminary Why: 1 report: Tech Times · subject to change · 1 independent report
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Status: no action reported
No source states: loss or records, developer and model, agent tool, could do, deployer.
Severity major: Test applied: live production compromise. Fact: the campaign against government and power-sector networks is described as still active at publication; no victim count or loss figure is stated.
Kaspersky publicly named a previously undocumented threat actor, Armored Likho, behind an ongoing cyber-espionage campaign against government agencies and electric power operators in Russia, Kazakhstan and Brazil. The campaign delivers BusySnake Stealer, a Python infostealer that harvests browser passwords, session cookies, OTP-related clipboard content and Telegram session data, and can open reverse SSH tunnels. Victims are reached through spear-phishing emails carrying malicious archives or shortcut files, and one chain uses CVE-2025-9491. Kaspersky found evidence that the group used large language models to generate its first-stage loader code. Microsoft fixed that flaw in its November 2025 Patch Tuesday update, and systems without the update remain vulnerable. Kaspersky describes the campaign as still active at the time of publication.
What happened
No source tells the story step by step yet.
What was done
No source states an action or fix.
Risks
Also96 incidents
Rising: 24 vs 4.0 a week
Read from the sources; not yet reviewed by a person.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
Harness ApplicationSensitive-data checks on outbound data · Output filtering and redaction · Human approval for high-impact actions · Data minimisation · Least-privilege access for the agent · Activity logs
Evidence
No source states: a step-by-step account, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Show the full account: 5 items from the primary sources
What happened, in order
- March 2025 CVE-2025-9491 is disclosed publicly by Trend Micro's Zero Day Initiative.
- November 2025 Microsoft addresses CVE-2025-9491 in its Patch Tuesday update.
- 2026-07 Kaspersky first documents BusySnake Stealer and publicly names Armored Likho.
- February 2026 Eagle Werewolf compromises a drone-focused Telegram channel to distribute AquilaRAT.
Not dated in the sources:
- The campaign is described as still active at publication.
Show every field, with its source and grade
What happened
Impact
Context
Notes on gaps
Eagle Werewolf overlap is described by the source as substantial but not confirmed, and the attribution is medium confidence per Kaspersky. The FAQ mentions cryptocurrency wallet scanning and the Russian Market, which do not appear in the body and were not used. Only a press article was supplied; the Kaspersky primary report was not read.
LR-2026-0622 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON