Researchers Detail Armored Likho’s BusySnake Stealer Campaign
Summary
Researchers detail campaigns attributed with medium confidence to Armored Likho against government and power-sector targets in Russia, Brazil and Kazakhstan, and analyze BusySnake Stealer’s credential theft, persistence, C2 tasking and reverse-SSH capabilities.
Key points
- Researchers attribute the campaign to Armored Likho with medium confidence, based on tooling and network similarities; the proposed link to Eagle Werewolf is described as circumstantial.
- Spear-phishing emails themed as government notices or social programs deliver malicious EXE or LNK files in archives, launching loaders that stage the stealer.
- BusySnake Stealer is a Python infostealer protected with PyArmor that dynamically decrypts its bytecode; it collects browser credentials and cookies, clipboard data, documents, screenshots, Telegram data and other files.
- C2 commands can trigger data exfiltration, reverse SSH tunneling, and RustDesk-related remote-control functions.
- Persistence uses scheduled tasks; a newer version creates tasks through a Windows COM interface and can execute downloaded Python scripts in memory.
- Researchers identified victims in Russia, Kazakhstan and Brazil, with campaigns primarily targeting government agencies and the electric power sector.
- Kaspersky says its solutions detect and block the activity, including the LNK downloader stage.
Article Details
- Attack Vectors
- Spear-phishing emails deliver malicious EXE, LNK, RAR, ZIP, or BAT files disguised as government notices, psychological tests, or aid-related documents.
- Malicious LNK files use concealed command-line parameters to invoke rundll32.exe and PowerShell, which downloads and executes a loader.
- Loaders download Python components and BusySnake Stealer payloads from attacker infrastructure and GitHub repositories.
- BusySnake Stealer establishes persistence with scheduled tasks and uses reverse SSH tunneling for remote access.
- The stealer collects and exfiltrates browser credentials and cookies, clipboard data, documents, screenshots, Telegram data, wallet files, and OTP-related secrets.
- Defensive Notes
- Kaspersky reports that its security solutions detect and block the activity, including the LNK downloader stage.
- Kaspersky Endpoint Detection and Response Expert detects the obfuscated rundll32.exe and PowerShell execution chain.
- Kaspersky Cloud Sandbox can be used to analyze the activity and observe payload downloads and subsequent execution stages.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | arvax[.]xyz | Domain listed as C2 infrastructure for the campaign. |
| DOMAIN | grked[.]online | C2 domain used by BusySnake Stealer for reverse tunnel creation. |
| DOMAIN | lvl99[.]store | Domain listed as C2 infrastructure for the campaign. |
| DOMAIN | myboard[.]chickenkiller[.]com | Domain listed as C2 infrastructure for the campaign. |
| DOMAIN | myboard[.]twilightparadox[.]com | Domain listed as C2 infrastructure for the campaign. |
| DOMAIN | ndrt[.]ink | Domain listed as C2 infrastructure for the campaign. |
| DOMAIN | onetoken[.]ink | Domain listed as C2 infrastructure for the campaign. |
| DOMAIN | varenie[.]live | Domain listed as C2 infrastructure for the campaign. |
| DOMAIN | winupdate[.]ink | Domain listed as C2 infrastructure for the campaign. |
| DOMAIN | winupdate[.]live | Domain listed as C2 infrastructure for the campaign. |
| IPV4 | 159[.]198[.]32[.]222 | Attacker-controlled server used for reverse SSH tunneling. |
| IPV4 | 159[.]198[.]41[.]140 | C2 server contacted by BusySnake Stealer. |
| IPV4 | 159[.]198[.]75[.]219 | Listed as C2 and tunneling infrastructure associated with the campaign. |
| IPV4 | 69[.]67[.]173[.]153 | Listed as C2 and tunneling infrastructure associated with the campaign. |
| MD5 | 0041fd1b2358cd08dbcbc28ea8fc3d20 | Hash of an EXE dropper used in the campaign. |
| MD5 | 006887732ca4a4a46a97989cf4deeef6 | Hash of a RAR archive containing BusySnake Stealer. |
| MD5 | 1096268fa2b3d454c86cf851cb782319 | Hash of an EXE dropper used in the campaign. |
| MD5 | 2dfa1d949872c1b2f04952dd3e5f5d8f | Hash of a malicious LNK file used in the campaign. |
| MD5 | 393b498f2114cabc0b29d5fcd9dc6723 | Hash of a malicious LNK file used in the campaign. |
| MD5 | 6b45ddb39a6e86229348dcbba3857e7c | Hash of a RAR archive containing BusySnake Stealer. |
| MD5 | 732c31acf971a81c7e51b2a3dae82020 | Hash of a RAR archive containing BusySnake Stealer. |
| MD5 | 80b7700053e115d65365ce7330383320 | Hash of a newer BusySnake Stealer PYW sample. |
| MD5 | 8188b2f347b77d65d08cfb23808ac244 | Hash of a RAR archive containing BusySnake Stealer. |
| MD5 | 90378881856abfa47d7745c0a3ef9dc8 | Hash of a RAR archive containing the advanced cookie-extractor module. |
| MD5 | c7622a1effa27bbfee6d6e03d6474343 | Hash of a BusySnake Stealer PYW sample. |
| MD5 | cf74ac018d158ea2c2cfa1b1d71d95bc | Hash of a malicious LNK file used in the campaign. |
| MD5 | ddff82a115558584bbd7741d4ffb35b4 | Hash of a RAR archive containing BusySnake Stealer. |
| MD5 | e2550cfad9dcc880bf04f6048f90868c | Hash of a RAR archive containing BusySnake Stealer. |
| MD5 | f2ab09d7e7a375a192508a5014aa2ee4 | Hash of an EXE dropper used in the campaign. |
| MD5 | fd2bdd8047addee6fde2f532de181bfd | Hash of a RAR archive containing BusySnake Stealer. |
MITRE ATT&CK
T1005 · Data from Local SystemThe malware collects documents, screenshots, Telegram session data, wallet files, and other data from local storage.T1027 · Obfuscated Files or InformationThe campaign conceals LNK command parameters and protects BusySnake Stealer code with PyArmor obfuscation and encryption.T1041 · Exfiltration Over C2 ChannelCollected files, credentials, screenshots, and other data are uploaded to the attacker-controlled C2 server.T1053.005 · Scheduled TaskBusySnake Stealer persists by registering a scheduled task that runs the payload, including through Schedule.Service COM in a newer version.T1055 · Process InjectionThe EXE dropper injects code into the pnx.exe process memory to execute a malicious loader.T1059.001 · PowerShellPowerShell downloads and executes the malicious loader from the LNK infection chain.T1071.001 · Web ProtocolsBusySnake Stealer communicates with its C2 over HTTP/HTTPS, including task polling and status-report requests.T1105 · Ingress Tool TransferLoaders fetch Python components, archives, and payloads from GitHub repositories and attacker infrastructure.T1115 · Clipboard DataBusySnake Stealer continuously polls and records clipboard contents, including OTP-related secrets.T1119 · Automated CollectionThe stealer automatically inventories files and scans local files for 64-character hexadecimal keys.T1204.002 · Malicious FileThe infection chain starts when a victim opens a malicious EXE or runs an archive-contained LNK file.T1218.011 · Rundll32The LNK chain invokes an obfuscated command through rundll32.exe before triggering PowerShell.T1555.003 · Credentials from Web BrowsersThe stealer decrypts saved Chromium and Firefox passwords and extracts browser cookies from local databases.T1566.001 · Spearphishing AttachmentArmored Likho sends spear-phishing emails with malicious archive attachments themed as government notices or aid programs.T1572 · Protocol TunnelingBusySnake Stealer establishes a reverse SSH tunnel using a private key and SSH parameters supplied by its C2 server.
Threat Actors
Armored LikhoKaspersky attributes the campaign to Armored Likho with medium confidence, citing tool and network-activity analysis; the group is reported to target government and electric power organizations.Eagle WerewolfThe article associates Eagle Werewolf with Armored Likho based on circumstantial evidence and describes it as an alternate name for the group.
Malware
Vendors
Products
Kaspersky Cloud SandboxThe Kaspersky Cloud Sandbox solution can be used for a comprehensive analysis of the malicious activity described here.Kaspersky Endpoint Detection and Response ExpertKaspersky security solutions, including Kaspersky Endpoint Detection and Response Expert, successfully detect and block the malicious activity associated with these attacks.Microsoft Windows[T1021.002] Remote Services: SMB/Windows Admin Shares Not Used; Remote SSH Tunneling – The malware establishes a reverse SSH tunnel for remote access.RustDesk#ArmoredLikho
Tools
Countries
BrazilResearchers uncovered Armored Likho, a previously unknown APT also linked to Eagle Werewolf, running phishing campaigns against government and electric power targets in Russia, Brazil, and Kazakhstan.KazakhstanResearchers uncovered Armored Likho, a previously unknown APT also linked to Eagle Werewolf, running phishing campaigns against government and electric power targets in Russia, Brazil, and Kazakhstan.RussiaResearchers uncovered Armored Likho, a previously unknown APT also linked to Eagle Werewolf, running phishing campaigns against government and electric power targets in Russia, Brazil, and Kazakhstan.
Industries
Electric powerResearchers uncovered Armored Likho, a previously unknown APT also linked to Eagle Werewolf, running phishing campaigns against government and electric power targets in Russia, Brazil, and Kazakhstan.GovernmentResearchers uncovered Armored Likho, a previously unknown APT also linked to Eagle Werewolf, running phishing campaigns against government and electric power targets in Russia, Brazil, and Kazakhstan.