Armored Likho is a newly observed APT group that targets government and electric power organizations across multiple countries, while also conducting financially motivated attacks and espionage in Russia, Brazil, and Kazakhstan. Its toolkit includes BusySnake Stealer, Go2Tunnel, and modular RATs that support credential theft, stealthy persistence, and remote control. #ArmoredLikho #BusySnakeStealer #Go2Tunnel #AquilaRAT
Keypoints
- Armored Likho targets government and electric power organizations in multiple countries.
- The group conducts both espionage and financially motivated attacks.
- Spear-phishing emails deliver executables or LNK files that hide malware installation.
- BusySnake Stealer steals credentials, cookies, screenshots, OTP keys, and Telegram data.
- The malware can establish reverse SSH tunnels and provide persistent remote access.
Read More: https://www.securityweek.com/armored-likho-apt-targeting-government-electric-power-entities/