Loading story…
Armored Likho, a previously undocumented APT group also linked by indirect indicators to Eagle Werewolf, has been running a spear-phishing campaign against government agencies and electric power organizations in Russia, Kazakhstan, and Brazil. The attackers deliver a newly identified Python-based infostealer, BusySnake Stealer, through archive attachments containing either NSIS-built executable droppers or malicious .lnk files, including samples that abuse ZDI-CAN-25373 to conceal command-line arguments. Researchers said the malware is heavily obfuscated with PyArmor and that some first-stage loaders appear to be AI-generated, complicating attribution while preserving the group’s broader tradecraft.
Once installed, BusySnake establishes persistence with VBScript and scheduled tasks, then steals browser passwords, cookies, clipboard contents, screenshots, documents, Telegram session data, OTP secrets, and cryptocurrency wallet files. The malware also supports reverse SSH tunneling and remote control, downloads Python runtimes and dependencies, and in newer variants fetches and executes Python payloads directly in memory while tracking task status through an updated C2 framework. Reported infrastructure includes 159.198.41[.]140 and grked[.]online, and researchers noted architectural overlap with AquilaRAT and functional similarities to Go2Tunnel, reinforcing the attribution to Armored Likho.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Securelist reported an active spear-phishing campaign attributed with medium confidence to the previously undocumented APT group Armored Likho, also referred to as Eagle Werewolf. The campaign targets government organizations and the electric power sector in Russia, Kazakhstan, and Brazil and delivers the newly identified Python-based BusySnake Stealer via malicious archive attachments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcesecurelist.com
Open sourcesecurelist.ru
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple phishing campaigns delivered **SnakeKeylogger**, **VIPKeylogger**, and **Agent Tesla** through layered infection chains that used obfuscated VBScript or PowerShell droppers, steganographic payload staging on Cloudinary, Internet Archive abuse, reflective in-memory .NET loading, and process hollowing into legitimate Windows binaries such as `Caspol.exe`, `Aspnet_compiler.exe`, and `RegAsm.exe`. One DHL-themed operation used a VIPKeylogger variant identified as a SnakeKeylogger rebrand, while a separate GuLoader campaign targeted Italian businesses with NSIS-wrapped stealers and business email compromise-style lures. Across the campaigns, the malware stole browser passwords, email and FTP credentials, Outlook and WinSCP secrets, Discord tokens, Wi-Fi passwords, screenshots, clipboard data, and keystrokes, then exfiltrated data over **SMTP**, **Telegram**, and **FTP**. Investigators found repeated operator OPSEC failures that exposed active criminal infrastructure and victim data. A VIPKeylogger/SnakeKeylogger operator left a stock **XAMPP** dashboard and internet-accessible **WinRM** open on `144.172.105.88`, while sandboxing captured plaintext SMTP credentials tied to `result@miniorangeman.com` on `185.196.9.150`; although that C2 was taken offline shortly after detection, the Cloudinary-hosted payload and SMTP infrastructure reportedly remained live. In a separate GuLoader operation, an open FTP directory on `holzbrenzii[.]com` exposed **52 credential dumps from 27 victim machines** in real time. Another SnakeKeylogger v4.4 campaign linked distinct droppers to the same backend through shared C2 strings, DDNS infrastructure, and staging artifacts, showing that technically capable malware operators repeatedly undermined their own campaigns by exposing panels, credentials, and stolen data.
Jun 29, 2026
Researchers reported an active cyberespionage campaign dubbed **Operation HumanitarianBait** that uses Russian-language humanitarian aid request themes to lure victims into opening a malicious `.lnk` file packaged inside a `.rar` archive. The shortcut launches PowerShell to decode obfuscated content, opens a decoy humanitarian aid PDF to distract the user, and silently installs a fileless, PE-less Python implant from **GitHub Releases** into a fake `WindowsHelper` directory under `%APPDATA%`. The payload is protected with **PyArmor v9.2 Pro**, helping it evade scrutiny while blending into legitimate developer traffic. Once installed, the malware establishes persistence through VBScript launchers and a recurring Windows Scheduled Task, then conducts broad surveillance and theft. Reported capabilities include browser credential and cookie theft, keylogging, clipboard and screenshot capture, file theft, and **Telegram** session theft, with optional covert remote access through **RustDesk** or **AnyDesk**. Stolen data is exfiltrated to a live custom Flask-based command-and-control server at `159.198.41[.]140` on a Namecheap VPS, and researchers said the Russian-language lures suggest the operation is aimed at Russian-speaking individuals or organizations, including those tied to aid distribution, civil administration, or government functions.
Jun 29, 2026
Kaspersky reported that the threat actor **Bloody Wolf**—tracked by the vendor as **Stan Ghouls**—is running a spear-phishing campaign primarily targeting organizations in **Uzbekistan** and **Russia**, with additional, lower-volume activity observed in other countries. The activity, ongoing since at least 2023, has targeted sectors including manufacturing, finance, and IT, and has also been observed hitting government, logistics, healthcare, and education entities. Reported victim counts for the current wave are on the order of **50+ in Uzbekistan** and **~10 in Russia**, with the actor assessed as likely financially motivated, though the heavy use of remote-access tooling may also support espionage objectives. The intrusion chain relies on phishing emails carrying **malicious PDF lures** (e.g., court/government-themed documents) that embed links leading to a downloader/loader, after which the actor deploys **NetSupport RAT** (a legitimate remote administration tool) for remote control—representing a shift from prior use of **STRRAT**. Kaspersky noted the loader’s behavior includes user-deception (fake error messages) and basic execution controls (e.g., limiting repeated installation attempts), while another reported lure uses a social-engineering pretext that victims must install a **Java Runtime Environment update**, ultimately delivering a **malicious JAR**—a technique Kaspersky described as a distinctive fingerprint for this actor. Prior related reporting cited phishing activity in Kyrgyzstan distributing similar tooling, indicating a broader regional focus beyond the current Uzbekistan/Russia emphasis.
Jun 29, 2026