Executive Summary
A new targeted phishing campaign by the Armored Likho (also known as Eagle Werewolf) APT group has been identified targeting government agencies and the electrical power sector across Russia, Brazil, and Kazakhstan. The campaign utilizes a previously undocumented Python-based infostealer dubbed BusySnake Stealer, which is designed to exfiltrate credentials, cookies, and system metadata. A notable trend in this activity is the use of AI-generated loaders and stagers, indicated by redundant comments and structured coding styles characteristic of Large Language Models.
The attack chain involves modular RATs and obfuscated Python code using PyArmor to bypass security solutions. Technical artifacts suggest a high degree of maturity, incorporating reverse SSH tunneling via Go2Tunnel-like logic directly into the stealer's core. The group maintains persistence through scheduled tasks and leverages vulnerabilities in Windows LNK file handling to execute malicious commands. The business impact includes the potential loss of sensitive government data, critical infrastructure access, and compromised cryptocurrency assets.