infostealer espionage spear-phishing Python malware threat actor

BusySnake: The Python Stealer Quietly Targeting Governments and Power Grids

15 July 2026

A threat actor called Armored Likho has been conducting cyber espionage and financially motivated attacks against government agencies and energy sector organisations in Russia, Brazil, and Kazakhstan, using spear-phishing emails as the initial entry point. The group deploys a newly discovered Python-based malware called BusySnake Stealer, which harvests credentials, browser cookies, keystrokes, cryptocurrency wallets, and Telegram data, while evading detection through dynamic bytecode encryption and obfuscation techniques. Kaspersky has linked Armored Likho to the previously tracked Eagle Werewolf cluster, noting the group is actively refining its toolkit — including integrating reverse SSH tunnelling directly into the stealer — and may be using AI tools to assist in generating its first-stage payloads.

A previously unnamed threat actor, now tracked as Armored Likho, has been running cyberattacks against government bodies and electricity sector organisations across Russia, Brazil, and Kazakhstan. The group mixes financially motivated hits on individuals with more deliberate espionage operations against institutions, which is an unusual combination that suggests either a flexible crew or one working to order.

Kaspersky published a technical breakdown this week attributing the campaign to Armored Likho, noting probable overlaps with a group BI.ZONE calls Eagle Werewolf. That cluster has been active since at least May 2023, with a particular interest in organisations involved in drone development and manufacturing. Eagle Werewolf previously made headlines in February 2026 when it hijacked a drone-focused Telegram channel to push AquilaRAT, disguised as a Starlink activation checklist. Neat.

The new addition to the group's toolkit is BusySnake, a Python-based infostealer targeting Windows systems. It lifts clipboard contents, enumerates files across the host, uploads documents, captures screenshots, logs keystrokes, hoovers up cryptocurrency wallet files, grabs Telegram session data, and extracts cookies and passwords from Firefox and Chromium browsers. If RustDesk happens to be installed, the malware starts it, waits for the victim to enter their credentials, screencaps the whole thing, and ships it off to the command-and-control server. Elegant, in a grim sort of way.

Go2Tunnel, previously a standalone utility for reverse SSH tunnelling, has now been folded directly into BusySnake itself. The C2 server feeds it the parameters it needs at runtime. The group is clearly consolidating its tooling rather than relying on a loose collection of separate components.

Evasion is a priority throughout. BusySnake decrypts its bytecode only when a specific function is actually called, then immediately re-encrypts it. It runs headless, with no console window, helped along by the PYW file extension. Static analysis tools are going to have a bad time with it.

Attack chains begin with spear-phishing emails impersonating government notices or social programme communications. These deliver RAR archives containing EXE droppers that pull additional payloads, including the stealer itself, from a GitHub repository. VBScript files handle cleanup and persistence via scheduled tasks. Alternate variants swap EXE payloads for LNK shortcut files exploiting CVE-2025-9491, a Windows shortcut handling vulnerability that Microsoft patched in November 2025. Trend Micro previously reported that this flaw had been actively exploited by roughly a dozen threat actors going back to 2017, so it was hardly a fresh zero-day by the time these campaigns ran.

Kaspersky's researchers also spotted what looks like AI-assisted code generation in the first-stage loaders, flagged by the presence of redundant comments and dead code blocks. Whether that reflects a junior developer leaning on ChatGPT or a deliberate obfuscation strategy is unclear, but it is becoming an increasingly common signature in commodity malware.

A newer version of BusySnake has also surfaced, introducing a task-management framework that assigns C2 commands formal operational states: SCHEDULED, IN_PROGRESS, SUCCEEDED, or FAILED. It is the kind of structured reporting you would build if you were managing multiple simultaneous intrusions and needed visibility across them.

The technical overlaps between BusySnake and AquilaRAT, specifically in how both malware families handle C2 tasking, register persistence, and communicate with infrastructure, underpin the link between Armored Likho and Eagle Werewolf. Whether they are the same group under different names, or two groups sharing tooling and infrastructure, the practical difference for defenders is limited.

The group's trajectory is clearly upward. More sophisticated obfuscation, modular architecture, integrated tunnelling, and a C2 reporting layer that would not look out of place in enterprise software. Keep an eye on this one.

READ NEXT

GoSerpent Malware Has Been Quietly Raiding Southeast Asian Governments for Months ACR Stealer Is Raiding Enterprise Networks and All It Needs Is for Someone to Press Enter Chinese Hackers Dressed as India's Tax Authority Are Deploying DcRAT on Finance Teams