Armored Likho APT - BusySnake Stealer (Multi-Stage)

Aamir Muhammad@Aamir

•updated Jul 10, 2026•16•1•32

Detects various stages of the Armored Likho APT campaign using the BusySnake stealer, including lure archive delivery, NSIS droppers, LNK shortcut abuse, PowerShell-based staging, VBScript persistence, scheduled task creation, reverse SSH tunneling, and exfiltration of browser and communication artifacts.