Armored Likho APT Deploys BusySnake Stealer Against Government and Power Sector Targets

Gbhackers •Mayura Kathir • July 4, 2026

A focused phishing campaign operated by a previously unreported APT we’ve named Armored Likho (also tracked under the provisional alias Eagle Werewolf). The group is targeting government agencies and the electric power sector across Russia, Brazil and Kazakhstan, and demonstrates an evolving toolkit that blends commodity and bespoke tooling to support both financially motivated operations […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Armored Likho APT Targets Power Grids with BusySnake Stealer Malware A newly identified APT group, Armored Likho, is conducting a phishing campaign targeting government agencies and electric power sectors in Russia, Brazil, and Kazakhstan. The group employs a sophisticated infostealer known as BusySnake Stealer, which is difficult to detect and recover from. Attack vectors include spear-phishing emails with malicious attachments disguised as legitimate documents. The campaign exploits CVE-2025-9491, urging immediate patching and auditing of scheduled tasks. Armored Likho operates dual tracks of cyber-espionage and financially motivated credential theft, affecting both critical infrastructure and private individuals. The group has been linked to previous activities under the alias Eagle Werewolf, with notable advancements in their malware toolkit. The campaign remains active and poses a significant threat to the targeted sectors. 7 sources 78

Extracted Entities

Armored Likho APT Deploys BusySnake Stealer Against Government and Power Sector Targets

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Campaigns (1)

Countries (3)

Industries (1)

Malware (1)

MITRE ATT&CK (1)