Armored Likho Targets Governments and Power Sectors With BusySnake

A previously undocumented threat actor known as Armored Likho has been attributed to cyber attacks targeting government agencies and the electric power sector across Russia, Brazil, and Kazakhstan. Kaspersky said “Armored Likho blends financially motivated campaigns targeting private individuals with targeted cyber espionage aimed at organizations” ¹. The attackers employ a tool called BusySnake, a credential‑stealing malware that functions as a remote access trojan (RAT). Experts note that this RAT has been observed in Southeast Asia since 2019; its presence here suggests potential attribution links or shared tooling between actors operating across different geopolitical landscapes and threat models.

The power‑sector focus raises particular alarm for critical infrastructure. Similar incidents involving Ukrainian energy infrastructure were carried out by the Sandworm group around December 2016, which caused widespread blackouts then—this highlights risk for essential services to be targeted again using this technique now that they have become more sophisticated.

BusySnake is a heavily obfuscated variant of the Azorult stealer. Back in 2023, similar campaigns employing slightly less sophisticated variants were linked to Russian APT groups targeting Ukrainian infrastructure; Armored Likho appears more professional and has broader geographic scope. Blending financial motives with espionage objectives indicates resilience—they can sustain operations even if some victims are not high‑value targets. Expect continued evolution as these actors adapt their tactics based on security responses.

For defenders, vigilance around credential theft vectors remains key: enforce least‑privilege principles, monitor anomalous RAT activity, and keep systems patched against known vulnerabilities. Monitoring unusual traffic between power‑sector networks and external command‑and‑control servers is also important, especially given the precedent set by Sandworm’s December 2016 blackouts.

In sum, Armored Likho’s use of BusySnake across multiple countries signals an emerging threat that fuses financial gain with state‑level espionage. Organizations in the public sector and critical infrastructure must review their defenses, particularly around remote access trojans, to guard against this evolving adversary.