--- title: Armored Likho's new weapon: BusySnake Stealer | daily.dev description: Kaspersky researchers have uncovered an active APT campaign by a group dubbed Armored Likho (also known as Eagle Werewolf), targeting government agencies and... canonical: https://daily.dev/posts/armored-likho-s-new-weapon-busysnake-stealer-jlglbr4ad copyright: © 2026 Daily Dev Ltd. terms: https://daily.dev/tos/ twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Armored Likho's new weapon: BusySnake Stealer | daily.dev og:description: Kaspersky researchers have uncovered an active APT campaign by a group dubbed Armored Likho (also known as Eagle Werewolf), targeting government agencies and... og:url: https://daily.dev/posts/armored-likho-s-new-weapon-busysnake-stealer-jlglbr4ad og:image: https://api.daily.dev/og/posts/jlGLBr4AD.png og:image:alt: Armored Likho's new weapon: BusySnake Stealer og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Armored Likho's new weapon: BusySnake Stealer **[Securelist](https://daily.dev/sources/securelist)** · 20 min read · 0 upvotes · 0 comments ## Summary Kaspersky researchers have uncovered an active APT campaign by a group dubbed Armored Likho (also known as Eagle Werewolf), targeting government agencies and electric power sectors in Russia, Kazakhstan, and Brazil. The group deploys a newly documented Python-based infostealer called BusySnake Stealer, delivered via spear-phishing emails with malicious EXE or LNK attachments. First-stage loaders are AI-generated, complicating attribution. BusySnake Stealer is obfuscated with PyArmor Pro, runs persistently via scheduled tasks, and features clipboard logging, file system enumeration, browser credential and cookie theft (Chromium and Firefox), screenshot capture, 2FA secret scraping, Telegram session harvesting, cryptocurrency wallet search, and reverse SSH tunneling. A newer version adds stealthier persistence via COM objects, in-memory Python script execution, and a task-management framework with status tracking. The malware shares architectural overlaps with AquilaRAT and Go2Tunnel, tools previously attributed to the same group. IoCs including file hashes and C2 domains are provided. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is BusySnake Stealer and what data does it steal? BusySnake Stealer is a previously undocumented Python-based infostealer used by the Armored Likho APT group to target Windows systems. It harvests clipboard data, browser passwords and cookies from Chromium and Firefox, Telegram session data, cryptocurrency wallet JSON files, 2FA/OTP secrets, screenshots, and documents, and can establish reverse SSH tunnels or enable remote control via RustDesk on infected hosts. _Track emerging infostealer campaigns and their techniques as they surface on daily.dev._ ### How does Armored Likho use AI in its malware campaigns? Armored Likho generates its first-stage loaders and stagers using AI, evidenced by verbose comments and bullet-point emoji in the source code that are uncharacteristic of human-written malware. This AI-assisted development blurs the group's tactics, techniques, and procedures and complicates attribution efforts for defenders analyzing the campaign. _Developers watching AI-assisted attack techniques evolve can follow the trend on daily.dev._ ### How does BusySnake Stealer decrypt saved Firefox passwords without a master password prompt? It exploits the fact that Firefox's NSS library stores the key4.db signing key in plaintext when no master password is set, allowing the malware to call PK11SDR_Decrypt() directly on data pulled from logins.json without any user interaction or re-authentication. Chromium-based browsers are handled separately using the Windows DPAPI to decrypt the Login State master key. _Security engineers assessing browser credential storage risks can dig deeper into these findings on daily.dev._ ## Similar posts on daily.dev - [BusySnake Stealer Slithers into Critical Infrastructure Networks](https://daily.dev/posts/busysnake-stealer-slithers-into-critical-infrastructure-networks-dcqwywayo) · Dark Reading · 0 upvotes · 0 comments - [New Armored Likho tools target Telegram and eavesdropping](https://daily.dev/posts/new-armored-likho-tools-target-telegram-and-eavesdropping-xtg4q18ob) · Securelist · 0 upvotes · 0 comments - [Operation HumanitarianBait: An Infostealer Campaign](https://daily.dev/posts/operation-humanitarianbait-an-infostealer-campaign-mxpu5wjgr) · Cyble · 0 upvotes · 0 comments - [New Arkanix stealer blends rapid Python harvesting with stealthier C\+\+ payloads](https://daily.dev/posts/new-arkanix-stealer-blends-rapid-python-harvesting-with-stealthier-c-payloads-4mryjekkj) · CSO Online · 0 upvotes · 0 comments - [Trojanized ESET Installers Drop Kalambur Backdoor in Phishing Attacks on Ukraine](https://daily.dev/posts/trojanized-eset-installers-drop-kalambur-backdoor-in-phishing-attacks-on-ukraine-amw6o2ru1) · The Hacker News · 1 upvotes · 0 comments --- Tags: [#python](https://daily.dev/tags/python), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/armored-likho-s-new-weapon-busysnake-stealer-jlglbr4ad) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Armored Likho's new weapon: BusySnake Stealer","url":"https://daily.dev/posts/armored-likho-s-new-weapon-busysnake-stealer-jlglbr4ad","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/armored-likho-s-new-weapon-busysnake-stealer-jlglbr4ad"},"datePublished":"2026-07-03T10:03:42.933Z","dateModified":"2026-09-14T09:07:26.792Z","description":"Kaspersky researchers have uncovered an active APT campaign by a group dubbed Armored Likho (also known as Eagle Werewolf), targeting government agencies and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fd8f854f191941d17d2a935684402f31?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fd8f854f191941d17d2a935684402f31?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Securelist","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Securelist","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/e4b9f556af7a4e74a179787362dd5b07","url":"https://daily.dev/sources/securelist"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/armored-likho-s-new-weapon-busysnake-stealer-jlglbr4ad","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"python,malware","timeRequired":"PT20M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Securelist","item":"https://daily.dev/sources/securelist"},{"@type":"ListItem","position":3,"name":"Armored Likho's new weapon: BusySnake Stealer"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/armored-likho-s-new-weapon-busysnake-stealer-jlglbr4ad#faq","mainEntity":[{"@type":"Question","name":"What is BusySnake Stealer and what data does it steal?","acceptedAnswer":{"@type":"Answer","text":"BusySnake Stealer is a previously undocumented Python-based infostealer used by the Armored Likho APT group to target Windows systems. It harvests clipboard data, browser passwords and cookies from Chromium and Firefox, Telegram session data, cryptocurrency wallet JSON files, 2FA/OTP secrets, screenshots, and documents, and can establish reverse SSH tunnels or enable remote control via RustDesk on infected hosts. Track emerging infostealer campaigns and their techniques as they surface on daily.dev."}},{"@type":"Question","name":"How does Armored Likho use AI in its malware campaigns?","acceptedAnswer":{"@type":"Answer","text":"Armored Likho generates its first-stage loaders and stagers using AI, evidenced by verbose comments and bullet-point emoji in the source code that are uncharacteristic of human-written malware. This AI-assisted development blurs the group's tactics, techniques, and procedures and complicates attribution efforts for defenders analyzing the campaign. Developers watching AI-assisted attack techniques evolve can follow the trend on daily.dev."}},{"@type":"Question","name":"How does BusySnake Stealer decrypt saved Firefox passwords without a master password prompt?","acceptedAnswer":{"@type":"Answer","text":"It exploits the fact that Firefox's NSS library stores the key4.db signing key in plaintext when no master password is set, allowing the malware to call PK11SDR_Decrypt() directly on data pulled from logins.json without any user interaction or re-authentication. Chromium-based browsers are handled separately using the Windows DPAPI to decrypt the Login State master key. Security engineers assessing browser credential storage risks can dig deeper into these findings on daily.dev."}}]} ```