Armored Likho APT Uses BusySnake Stealer in Espionage Operations
Summary
Kaspersky reports that Armored Likho targets government and electric power organizations in multiple countries. Its tools include BusySnake Stealer, which can collect credentials and other data, capture screenshots, and provide remote access.
Key points
- Kaspersky says Armored Likho conducts cyber-espionage against organizations in Russia, Brazil, and Kazakhstan, as well as financially motivated attacks against individuals.
- The actor mainly uses spear-phishing emails with executable or LNK attachments that show decoys while malware installs in the background.
- BusySnake Stealer is a Python-based tool with evasion features that can dynamically decrypt and re-encrypt bytecode.
- Depending on commands from its command-and-control server, the stealer can collect keystrokes, browser passwords and cookies, OTP keys, Telegram sessions, and cryptocurrency wallets.
- The malware can capture screenshots, exfiltrate documents, execute commands, and establish a reverse SSH tunnel for remote access and interactive control.
- Kaspersky says Armored Likho previously relied on Go2Tunnel for reverse SSH tunneling and that its activity appears to overlap with Eagle Werewolf.
Article Details
- Attack Vectors
- Armored Likho uses spear-phishing emails with attached archives containing executables or LNK files.
- When opened, the executable or LNK file displays a decoy while malware is installed in the background.
- A loader was observed fetching archives from GitHub repositories; LNK files also fetch a Python 3.12 interpreter and an archive in the background.
MITRE ATT&CK
T1005 · Data from Local SystemThe malware searches the victim machine for OTP keys, cryptocurrency wallets, documents, and other local data.T1041 · Exfiltration Over C2 ChannelThe stealer can exfiltrate documents and logged keystroke data in operations controlled through commands from its C&C server.T1056.001 · KeyloggingThe malware can exfiltrate logged keystroke data.T1059.006 · PythonThe LNK files fetch a Python 3.12 interpreter, and BusySnake Stealer is Python-based.T1113 · Screen CaptureBusySnake Stealer can capture and archive screenshots.T1115 · Clipboard DataBusySnake Stealer has a handler for clipboard theft.T1204.002 · Malicious FileThe malware is installed after a recipient opens an executable or LNK file from an email attachment.T1539 · Steal Web Session CookieThe stealer can extract cookies from browsers.T1555.003 · Credentials from Web BrowsersBusySnake Stealer can decrypt stored passwords from Chromium-based and Firefox browsers.T1566.001 · Spearphishing AttachmentArmored Likho mainly uses spear-phishing emails with malicious archives attached for initial access.T1572 · Protocol TunnelingGo2Tunnel and BusySnake Stealer can establish a reverse SSH tunnel for remote access and network tunneling.
Threat Actors
Armored LikhoKaspersky reports that Armored Likho conducts financially motivated attacks against individuals and cyber-espionage operations against organizations, including government and electric power entities.Eagle WerewolfKaspersky reports that Armored Likho’s operations appear to overlap with Eagle Werewolf activity; Eagle Werewolf was previously seen using AquilaRAT.
Malware
AquilaRATPreviously, the hacking group was seen using the AquilaRAT RAT, which shares a similar structure and persistence mechanism with BusySnake Stealer.BusySnake StealerThe threat actor’s arsenal includes modular remote access trojans (RATs) and information stealers, including the Python-based BusySnake Stealer, and tools like Go2Tunnel for remote access and network tunneling.
Products
Chromiumthe malware can capture screenshots, exfiltrate logged keystroke data, decrypt stored passwords from Chromium-based and Firefox browsers, extract cookies from browsers, scrape the machine for OTP keys, findMozilla Firefoxcapture screenshots, exfiltrate logged keystroke data, decrypt stored passwords from Chromium-based and Firefox browsers, extract cookies from browsers, scrape the machine for OTP keys, find cryptocurrency wallets,RustDeskwallets, harvest Telegram sessions and credentials, establish a reverse SSH tunnel, and restart RustDesk to capture users’ credentials.
Tools
Countries
BrazilDubbed Armored Likho, the APT engages both in financially motivated attacks against individuals and in cyber-espionage operations against organizations in Russia, Brazil, and Kazakhstan.KazakhstanDubbed Armored Likho, the APT engages both in financially motivated attacks against individuals and in cyber-espionage operations against organizations in Russia, Brazil, and Kazakhstan.RussiaDubbed Armored Likho, the APT engages both in financially motivated attacks against individuals and in cyber-espionage operations against organizations in Russia, Brazil, and Kazakhstan.
Industries
Electric powerA recently discovered advanced persistent threat (APT) actor has been targeting government and electric power organizations in multiple countries, Kaspersky reports.GovernmentA recently discovered advanced persistent threat (APT) actor has been targeting government and electric power organizations in multiple countries, Kaspersky reports.