Kaspersky Unveils Armored Likho APT Group Using AI-Generated Malware

Kaspersky’s threat research team has uncovered a new advanced persistent threat (APT) group known as Armored Likho, also referred to as Eagle Werewolf. This group operates dual tracks: one focused on financially motivated attacks against individuals and the other on targeted espionage aimed at government agencies and electric power organizations in Russia, Kazakhstan, and Brazil. This dual approach is atypical, as most APT groups typically specialize in one area.

Armored Likho employs a modular and evolving toolkit that includes obfuscated remote access Trojans (RATs), a newly identified Python-based infostealer named BusySnake Stealer, and Go2Tunnel for remote access and network tunneling. Kaspersky's report highlights that the toolkit is specifically engineered to bypass dynamic analysis, allowing the group to maintain stealthy control over compromised systems while exfiltrating sensitive information.

The attack chain initiated by Armored Likho begins with spear-phishing messages that use various lures, such as official government notices or humanitarian aid applications. These messages contain attached archives that either include executables or LNK shortcut files, cleverly named to align with the email's narrative. The executable variant is a self-extracting archive that opens a fake psychological survey while injecting a loader into a legitimate process. This loader subsequently downloads additional malware components from GitHub repositories.

The LNK variant exploits the ZDI-CAN-25373 shortcut vulnerability, allowing attackers to conceal execution parameters. When executed, it presents a decoy document while PowerShell retrieves the loader, which then downloads the BusySnake Stealer payload along with a Python interpreter. Both infection methods ultimately lead to the same malware execution point.

Notably, the loader's source code features verbose comments and bullet-point emojis, a style that is atypical for human-written malware. This suggests that the group may be utilizing large language models (LLMs) to generate their malicious payloads, allowing for rapid variation in their tactics, techniques, and procedures (TTPs) with minimal development effort.

BusySnake Stealer operates silently, protected by PyArmor Pro 9.2.0, and begins monitoring the clipboard and building a local SQLite database of the file system upon execution. It specifically targets cryptocurrency private keys and API secrets, forwarding any matches to its command and control (C2) server. The malware also exfiltrates documents from specific folders and maintains persistence through a VBScript launcher and scheduled tasks.

The malware's capabilities extend to extracting passwords from Chromium-based browsers and Firefox, utilizing built-in libraries to access encrypted databases without user interaction. Additionally, it can capture cookies, scrape one-time passwords, and harvest session data from applications like Telegram. The reverse SSH tunneling function, previously handled by Go2Tunnel, is now integrated into BusySnake Stealer, allowing for persistent access to compromised hosts.

Kaspersky has observed that the latest version of BusySnake Stealer employs refined techniques for task management and command execution, making it harder to detect through standard behavioral rules. The group has shown a trend towards using AI tools to generate first-stage payloads, enhancing their operational capabilities.

Attribution of this campaign to Armored Likho is made with medium confidence, as there are structural similarities between BusySnake Stealer and previously used malware like AquilaRAT. The campaign remains active, with confirmed victims in Russia, Kazakhstan, and Brazil, particularly within government and electric power sectors. Kaspersky continues to monitor the group's activities and evolving tactics closely, as they remain a significant threat in the cybersecurity landscape.