A newly identified threat actor, dubbed Armored Likho, has been observed conducting targeted phishing campaigns against government agencies and the electric power sector in Russia, Brazil, and Kazakhstan. This group, also referred to as Eagle Werewolf based on circumstantial evidence, employs a sophisticated toolkit that includes a previously undocumented information stealer named BusySnake Stealer. The campaign, which was active at the time of reporting, showcases the group's increasing technical capabilities and a trend towards more complex methods for bypassing security solutions.
Armored Likho appears to blend financially motivated attacks targeting individuals with cyber-espionage operations against organizations. Their arsenal includes modular remote access trojans (RATs) and infostealers designed to evade dynamic analysis, alongside simpler tools like Go2Tunnel for remote access and network tunneling. This diverse malware strategy allows the attackers to maintain stealthy control over compromised systems, exfiltrate sensitive data, and deploy custom modules based on victim profiles.
A key highlight of this campaign is the use of BusySnake Stealer, a Python-based infostealer targeting Windows systems. Multiple versions of this stealer, along with a dedicated cookie-stealing module, have been identified. Notably, the initial malicious payloads, including loaders and stagers, were reportedly generated using artificial intelligence, which complicates attribution efforts by obscuring the attackers' tactics, techniques, and procedures (TTPs).
The primary infection vector for this campaign is spear-phishing emails. Armored Likho utilizes themes such as official government notices and social programs to entice recipients. In a recent campaign, malicious attachments were distributed within archive files. These archives contained executable files or LNK (shortcut) files, with names designed to mimic the email's theme, aiming to trick users into executing them.
One observed attack variant involved an archive containing a dropper file, identified as `psihologicheskiy_test.exe`. This dropper was built using the Nullsoft Scriptable Install System (NSIS) and, upon execution, launched a decoy application presenting a fake psychological survey to allay suspicion. While similar droppers have been seen in previous campaigns by the group, earlier versions were written in Rust, whereas this variant was observed to be written in Python.
Once executed, the dropper writes a legitimate executable, `$temp\nsn5531.tmp\pnx.exe`, to disk and then launches it. Malicious code is injected into the memory of the `pnx.exe` process, initiating a malicious loader. This loader subsequently fetches archives from GitHub repositories, which contain early development builds and test samples of the malware. The automated data release in these repositories allows for rapid rotation of both payloads and the repositories themselves.
The downloaded archives are extracted into a working directory, `$appdata\WindowsHelper`, where subsequent attack components are staged. This package includes the primary payload, `module.pyw` (the BusySnake Stealer), a runtime environment for PyArmor, a Python 3.12 interpreter, and a `get-pip.py` script used to install the pip package manager and download necessary dependencies. After installation, two VBScript files are created: `wh_selfdelete.vbs` to remove the initial loader and `run.vbs` to execute `module.pyw` and establish persistence via a scheduled task that runs every five minutes.
In alternative attack scenarios, archives contained a malicious LNK file. The attackers leveraged a vulnerability, identified as ZDI-CAN-25373, to conceal execution parameters within the shortcut file, exploiting spaces or line breaks to hide command-line arguments. When the user runs the malicious LNK file, it triggers an obfuscated PowerShell command that downloads and executes the malicious loader.
Following loader execution, a decoy DOCX document is downloaded and opened, with themes varying from humanitarian aid requests to debt clearance certificates. The loader then initializes environment variables for the next stage, including URL paths, installation directories, and library manifests. It proceeds to download a Python 3.12 interpreter, the `get-pip.py` script, and a `data.zip` archive containing the `module.pyw` payload. From this point, the process mirrors the first infection vector, with dependencies being installed and persistence established through VBScript and a scheduled task. The verbose comments and emojis observed in the loader's source code are uncharacteristic of human-developed malware and strongly suggest the use of Large Language Models (LLMs) in generating these payloads.
The BusySnake Stealer itself is a Python-based infostealer that employs multiple evasion techniques to hinder detection and static analysis. Its code is obfuscated and encrypted using PyArmor Pro version 9.2.0. The malware decrypts its bytecode dynamically only when a function is called, re-encrypting it immediately afterward. The use of the `.PYW` file extension indicates that the malware runs in the background without spawning a console window. Researchers were able to strip the protector and disassemble the executable functions.
The stealer is designed to exfiltrate passwords from Firefox and Chromium-based browsers and extract cookies. It also utilizes reverse SSH tunneling as part of its operations. The specific versions of the malware and the GitHub repositories used for hosting payloads were documented by researchers, providing indicators of compromise for detection and mitigation.
