New APT Group Hits Power Grids in Three Countries with AI-Crafted Malware

Kaspersky has publicly named a previously undocumented threat actor — Armored Likho — behind an ongoing cyber-espionage campaign hitting government agencies and electric power operators across Russia, Kazakhstan, and Brazil. The disclosure, published Thursday on Kaspersky's Securelist threat intelligence platform, documents a novel Python-based infostealer called BusySnake Stealer that is still active, still unattributed to any named nation-state, and equipped with technical capabilities that make both detection and forensic recovery exceptionally difficult. Security teams in the targeted sectors need to patch CVE-2025-9491 and audit scheduled tasks immediately — not quarter.

The group distinguishes itself from most APT actors by running two parallel tracks simultaneously: targeted espionage against critical national infrastructure, and financially motivated credential theft against private individuals. That combination means that even in cases where Armored Likho's espionage objectives are not met, credentials harvested from government and utility employees — browser passwords, session cookies, OTP codes, and Telegram session data — are the same categories of data that sell on dark-web markets for as little as $1 per log within hours of theft, enabling downstream fraud, account takeovers, and ransomware attacks by unrelated criminal actors long after the original intrusion.

Kaspersky attributes the campaign to Armored Likho with medium confidence — a specific term in threat intelligence meaning the attribution is supported by multiple converging indicators but remains unconfirmed by definitive proof such as an indictment or signals-intelligence corroboration. The group overlaps substantially with a threat cluster tracked by Russian cybersecurity firm BI.ZONE under the name Eagle Werewolf, which has been documented active since May 2023. Eagle Werewolf's prior record includes targeting government and defense organizations, specifically entities involved in UAV development and manufacturing, and using compromised Telegram channels to distribute malware.

The latest Kaspersky findings show a meaningful evolution. In February 2026, Eagle Werewolf was observed compromising a drone-focused Telegram channel to distribute a malware family called AquilaRAT, delivered via a Rust-language dropper disguised as a checklist for Starlink device activation. The tools and techniques in the BusySnake Stealer campaign, however, are substantially more sophisticated than that earlier operation.

Armored Likho reaches its victims through spear-phishing emails calibrated to each target environment, with lures ranging from official government notices to humanitarian aid applications. Two distinct infection chains have been documented, and both ultimately deliver BusySnake Stealer.

In the first chain, a malicious archive contains an executable dropper built with the Nullsoft Scriptable Install System (NSIS). When a victim opens it, a convincing decoy application — in one documented case, a fake psychological survey — launches to disarm suspicion. Simultaneously, code injected into a legitimate Windows process fetches additional components from a GitHub repository: the BusySnake payload itself, a Python 3.12 interpreter, and the pip package manager installer. Everything is staged in a folder named WindowsHelper inside the user's AppData directory. Two VBScript files then establish persistence: one erases the initial dropper to cover tracks, and the other creates a scheduled task that relaunches the stealer every five minutes.

The second chain uses Windows shortcut (.lnk) files and exploits CVE-2025-9491, also known as ZDI-CAN-25373. This vulnerability — disclosed publicly by Trend Micro's Zero Day Initiative in March 2025 after Microsoft initially declined to patch it — allows attackers to hide malicious command-line arguments inside a shortcut file using whitespace padding, so that inspecting the file in Windows shows only an innocuous-looking target. Microsoft silently addressed the flaw in its November 2025 Patch Tuesday update by forcing the Properties dialog to display the full command string. The fix matters because systems that have not received that update remain vulnerable. When a victim opens the malicious shortcut, Windows executes a hidden, obfuscated PowerShell command that downloads the -stage loader and displays a decoy document — humanitarian aid request forms, debt clearance certificates — while the environment is prepared for BusySnake. Persistence follows the same VBScript and scheduled-task pattern as the EXE chain.

BusySnake Stealer is obfuscated using PyArmor Pro 9.2.0, a commercial Python protection tool the attackers have repurposed defensively. The mechanism matters: rather than encrypting the entire payload at once, PyArmor decrypts individual function bytecodes at the exact moment they are called, re-encrypts them immediately afterward, and never holds the full decrypted codebase in memory at one time. The effect is that memory-dump analysis of a running BusySnake process yields mostly encrypted noise. It also executes using Python's .pyw file extension, which suppresses the console window and keeps the process invisible during normal system use.

Once running, BusySnake operates as a C2-controlled implant with a handler-based architecture. Without any instruction from the attacker, it continuously harvests clipboard content — logging everything pasted or copied with timestamps, which captures OTP codes, passwords, and sensitive text as users type or paste them — and builds a local inventory of the file system stored in a SQLite database. It automatically exfiltrates documents from Desktop, Documents, and Downloads directories if they are under 5 MB and have not been previously sent. It also takes periodic screenshots and stores them locally before archiving and transmitting them.

On command from the C2 server, BusySnake can execute a comprehensive additional toolkit. Password theft from Chromium-based browsers (Chrome, Edge, Brave) uses the Windows Data Protection API (DPAPI): the malware operates within the current user's security context to call win32crypt.CryptUnprotectData() and decrypt the browser master key, then runs an SQL query against the browser's Login Data file to extract plaintext passwords. Firefox password theft takes a different and particularly notable path: BusySnake loads Firefox's own NSS cryptographic library, calls NSS_Init() to access the browser's key4.db database, and then calls PK11SDR_Decrypt() to decrypt stored credentials. This works without any user interaction because Firefox, when no master password has been set by the user, stores its signing key in key4.db in a form that any process with access to the file can decrypt — a long-documented insecure default. Kaspersky's report explicitly describes this as exploiting "insecure Firefox browser practices."

Cookie theft uses two methods: direct SQL queries against the Cookies database files for Chromium browsers and the cookies.sqlite file for Firefox, and an alternative path that installs a malicious browser extension via a dynamically-downloaded module. The extension creates a local web server on port 8000, intercepts cookies through a Service Worker script, and transmits them to BusySnake's staging area. For 2FA secrets, the stealer monitors the clipboard for strings matching the otpauth:// pattern — the format used by Google Authenticator, Authy, and similar apps when keys are shared or backed up. Matching strings are logged to a file and exfiltrated. Telegram session data is collected by force-terminating the Telegram process, compressing its entire tdata session directory, and uploading the archive — effectively hijacking the victim's Telegram identity.

Remote access is established through RustDesk, the open-source remote desktop application. If RustDesk is not already installed, BusySnake downloads it from GitHub. If it is present, the malware restarts it to prompt the user to re-enter their ID and password, then captures a screenshot of those credentials and exfiltrates it.

Among the more operationally significant findings in the Kaspersky report is evidence that Armored Likho is using large language models to generate its first-stage loader code. Kaspersky researchers identified loader samples containing verbose inline , bullet-point emojis in the source, and redundant code blocks — stylistic patterns that are consistent with LLM output and highly inconsistent with human-crafted malware. Arctic Wolf Labs documented the same signature across more than 22,000 files in a rolling study from February 2025 to February 2026, noting that Brazilian and Portuguese-linked samples frequently contained emoji in ; Armored Likho's materials exhibit the same characteristic.

The significance is not simply stylistic. Traditional coding-style fingerprinting — analyzing function naming conventions, whitespace patterns, vocabulary, and structural choices — is a primary tool for linking new malware samples to known threat actors. AI-generated code erases those fingerprints because the LLM produces code whose style reflects training data rather than any individual developer's habits. CrowdStrike's Global Threat Report 2026 documented an 89% increase in AI-enabled attacks in 2025, and Google's Threat Intelligence Group has confirmed multiple threat actors are specifically using LLMs to generate obfuscation and evasion code. Armored Likho's use of this technique is not novel in the industry — but it is one of the earliest documented cases of its use by an APT group whose primary mission is critical infrastructure espionage rather than commodity cybercrime.

During infrastructure analysis, Kaspersky uncovered a more recent version of BusySnake that introduces additional evasion and operational improvements. Instead of calling the Windows schtasks command-line utility to create its scheduled persistence task — a behavior that commonly triggers endpoint detection rules — the newer version uses the Windows COM object interface, specifically the Schedule.Service COM object via Python's win32com.client library. The behavioral difference is significant: schtasks invocations are heavily monitored by modern endpoint security products; COM-based task creation through the same interface that Windows itself uses is substantially harder to distinguish from legitimate system activity.

The newer version also introduces a structured task-management framework in which each C2 command is assigned a unique identifier and tracked through four lifecycle states: SCHEDULED, IN_PROGRESS, SUCCEEDED, or FAILED. This gives the operators a real-time dashboard view of their intrusion status across all active victims simultaneously. Perhaps most significantly, the updated variant adds in-memory Python script execution: arbitrary scripts delivered by the C2 server are run directly inside the malware's process without ever being written to disk, eliminating a key forensic artifact that incident responders typically rely on when reconstructing an intrusion.

The group previously used a standalone Go-based tool called Go2Tunnel to establish reverse SSH tunnels — a technique that creates an outbound connection from the victim to the attacker's server, bypassing firewall rules that block inbound connections. That functionality is now embedded directly into BusySnake as a native built-in. When the C2 server sends a tunnel command, BusySnake contacts grked[.]online to receive a dynamically issued private SSH key and a pre-constructed SSH command specifying the attacker's server, port, and tunnel parameters. The malware establishes the reverse tunnel using those parameters, giving the attackers interactive access to the compromised host. When the tunnel is no longer needed, the private key is deleted from the victim machine. The integration of this capability into the stealer itself reduces the number of separate tools that need to be deployed and detected.

Confirmed victims span Russia, Kazakhstan, and Brazil — three countries with no obvious common geopolitical alignment that would explain a single actor's interest. Kaspersky notes that the targeting calculus appears to be driven by access to government and power sector networks rather than a unified national interest in any of the three countries. The electric power sector, in particular, is high-value espionage terrain: persistent access to operational technology environments can yield intelligence on grid topology, outage response procedures, equipment configurations, and personnel data — the kind of information that could support grid disruption planning without immediately triggering an incident.

The dual financial crime and espionage track suggests either that the group sells or monetizes harvested credential data from financial victims to fund its infrastructure, or that it operates as a contracted service for multiple clients — a model documented in the APT41 precedent (also known as Double Dragon), where the same operators conducted both state- espionage and independent financial cybercrime.

Kaspersky describes the campaign as still active at the time of publication. Organizations in government and energy sectors should treat the following actions as immediate priorities rather than routine maintenance.

First, confirm that all Windows systems have received the November 2025 cumulative update that addressed CVE-2025-9491. Systems that missed this update remain vulnerable to the LNK-based infection chain, which is being actively exploited by Armored Likho and has previously been used by 11 other state- groups from North Korea, Iran, Russia, and China since at least 2017. For organizations unable to immediately patch legacy systems, the security firm 0patch offers a micropatch that blocks .lnk files with Target fields longer than 260 characters from executing in Windows Explorer.

Second, audit scheduled tasks across endpoints for unexpected entries bearing names like WindowsHelper or that trigger Python interpreter execution. Armored Likho's persistence mechanism is consistent and auditable.

Third, monitor for outbound SSH connections from endpoints that have no legitimate reason to initiate them. BusySnake's tunneling capability uses a standard SSH command with a consistent argument pattern (-N -o ExitOnForwardFailure=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null) that behavioral detection can flag.

Fourth, audit browser credential stores. DPAPI-based decryption of Chrome master keys and Firefox's key4.db access are detectable behaviors if endpoint security is configured to monitor them. Users without Firefox master passwords set are specifically vulnerable to the Firefox credential theft path and should set one immediately.

Kaspersky has published a full list of indicators of compromise — file hashes, C2 domains, and IP addresses — on the Kaspersky Securelist Armored Likho report .

BusySnake Stealer is a Python-based infostealer first documented by Kaspersky in July 2026. It targets Windows systems and is delivered through spear-phishing emails containing either NSIS-based executable droppers or malicious shortcut (.lnk) files. Once installed, it steals browser passwords from Chromium and Firefox, harvests session cookies and OTP codes, collects Telegram session data, scans for cryptocurrency wallet files, and establishes reverse SSH tunnels to give attackers remote access. It is obfuscated with PyArmor Pro 9.2.0, making dynamic analysis difficult.

CVE-2025-9491 was addressed in Microsoft's November 2025 Patch Tuesday update. Any Windows system that has not received that cumulative update remains vulnerable. To check: verify Windows Update history for the November 2025 cumulative update, or run a patch compliance scan against Microsoft Security Advisory ADV25258226. The 0patch micropatch is an alternative for systems that cannot immediately apply the full update. Organizations running legacy Windows versions may require additional assessment.

Stealer logs — packages of harvested usernames, passwords, session cookies, and 2FA codes — sell on markets like Russian Market for as little as $1 per log, often within hours of theft. Once purchased by unrelated criminal actors, active session cookies remain valid until the application explicitly revokes them, regardless of a password reset. A separate attacker who purchases a government employee's session cookie can access that employee's email, cloud storage, or internal systems without needing their password at all. This means that even if Armored Likho's specific espionage objectives are not achieved, the harvested data may fuel a second wave of account takeovers, ransomware staging, and business email compromise attacks by buyers with no connection to the original intrusion.

Kaspersky's analysis found evidence that Armored Likho used large language models to generate its first-stage loader code — specifically, the presence of verbose inline , bullet-point emoji, and redundant code blocks consistent with LLM output. The operational consequence is that AI-generated code erases the stylistic fingerprints that threat intelligence analysts traditionally use to link new malware samples to known threat groups. Without those fingerprints, attribution based on coding style alone becomes much harder, buying the attacker time and complicating any legal or diplomatic response. CrowdStrike's Global Threat Report 2026 found an 89% increase in AI-enabled attacks in 2025; Armored Likho's use of this technique specifically for attribution evasion represents a documented escalation of the tactic beyond commodity cybercrime into state-level (or state-adjacent) espionage.