Armored Likho the hybrid threat that fuses financial theft and spying directed against critical infrastructure

A new threat actor that researchers have baptized as Armored Likho It emerges as a disturbing example of the hybridization between financial cybercrime and targeted cyberespionage: according to Kaspersky's technical analysis, his operations combine campaigns to steal money from individuals with attacks on government agencies and the electricity sector in countries such as Russia, Brazil and Kazakhstan.

The technical sophistication described by analysts is remarkable. Armored Likho uses a chain of attack that starts with speed-phishing and RAR files that hide executable or LNK shortcuts, explores a prior vulnerability in the management of direct Windows access (parked in the November 2025 updates) and uses droppers that download modules from public repositories. Its arsenal includes modular RATs and a new infostealer in Python called BusySnake, which integrates advanced obfuscation techniques, persistence through programmed tasks and exfiltered functions from cookies and credentials to cryptographic wallet files.

In addition to BusySnake, the group incorporates inverse tunnel utilities such as Go2Tunnel and legitimate remote software (RustDesk) to maintain persistent access and facilitate remote control. The use of Telegram channels to distribute payloads - including drones-related baits or connectivity services - shows how social engineering and the exploitation of public platforms are combined to achieve specific objectives.

The implications for public entities and critical infrastructure operators are clear: the ability to create reverse SSH tunnels, extract cookies and passwords, and run custom modules increases the risk of sustained espionage, exfiltration of sensitive designs (e.g. in the UAV sector) and side movements that can compromise supply chains or industrial control systems.

From a defensive perspective, there are measures that significantly reduce the surface of attack. First, immediately apply the official patches of Microsoft and other suppliers, and review that the November 2025 updates related to the management of LNK shortcuts are properly deployed in all endpoints. Second, tighten the execution of binaries from compressed files and unreliable origins, and block or examine traffic to public repositories where possible, as attackers use GitHub or other hosts to deliver useful charges.

Detection should focus on less obvious compromise indicators than the simple hash of a malware: search for new or unusual programmed tasks, presence of VBScript scripts that delete traces, files with suspicious extensions such as PYW or outcast loaders artifacts, PowerShell activity with encoded commands and persistent outgoing connections indicating reverse SSH tunnels. The introduction of anti-analysis mechanisms by BusySnake (dynamic deciphering of bytecode to flight) requires prioritizing EDR solutions with behaviour analysis and network telemetry capabilities.

Beyond technology, organizational countermeasures are critical: implementing robust multifactor authentication, rotating sensitive credentials after an incident, segmenting networks to limit the scope of remote access, and establishing clear processes for managing legitimate remote access software (such as RustDesk), including facility verification and unauthorized self-boot deactivation. It is also appropriate to monitor and moderate public communication channels used by employees (including Telegram) to prevent targeted baits from finding internal victims.

For incident response teams, the recommended immediate steps are to isolate suspicious equipment, capture forensic memory and disk images, review scheduled tasks and VBScript scripts, and check active reverse SSH tunnels or RustDesk processes in operation. Recovery should include the revocation of private keys, forced rotation of credentials and restoration from clean copies after forensic analysis.

Finally, although Kaspersky points to technical overlap with an actor called Eagle Werewolf (followed by BI.ZONE) and there is evidence of the sharing of techniques and endpoints between families such as AquilaRAT and BusySnake, the ultimate attribution remains complex: the exploitation of public tools, the use of open channels and the possible assistance of IA in the generation of payloads make it difficult to draw a single signature. To keep up-to-date on mitigation and related vulnerability alerts, see sector sources such as the Kaspersky site for technical analysis and the Microsoft update guide: Kaspersky Securelist and Microsoft Update Guide. It is also recommended to review response reports and threats from other suppliers such as Trend Micro to contrast IOCs and tactics: Trend Micro Research.