---
title: APT Group 'Armored Likho' Hits Power Grids with New AI-Assisted Malware
description: Discover how the "Armored Likho" group uses AI-generated loaders in spear-phishing attacks on government and power sector targets in Russia, Brazil and Kazakhstan.
canonical_url: https://codekeeper.co/ticker/armored-likho-targets-critical-infrastructure
---

# APT Group 'Armored Likho' Hits Power Grids with New AI-Assisted Malware

Discover how the "Armored Likho" group uses AI-generated loaders in spear-phishing attacks on government and power sector targets in Russia, Brazil and Kazakhstan.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Jul 7, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Farmored-likho-targets-critical-infrastructure%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Farmored-likho-targets-critical-infrastructure%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Farmored-likho-targets-critical-infrastructure%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Farmored-likho-targets-critical-infrastructure%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Farmored-likho-targets-critical-infrastructure%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Farmored-likho-targets-critical-infrastructure%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Kaspersky has documented a new weapon in the hands of Armored Likho, a threat group it has tracked before: a previously undocumented, Python-based infostealer called "BusySnake." The group is targeting government agencies and electrical power entities across Russia, Brazil and Kazakhstan with spear-phishing emails disguised as official government or social assistance communications. BusySnake steals browser passwords and cookies, clipboard contents, cryptographic keys, and Telegram session data, and opens backdoor access through reverse SSH tunnels and remote-access software. It consolidates into one tool what the group previously ran as separate components, including its Go2Tunnel utility. Kaspersky also sees the group leaning on AI to build its first-stage loaders — inferred from redundant comments and code blocks atypical of human developers, rather than from any recovered tooling. The group's nation-state affiliation remains unconfirmed. Source: [Dark Reading](https://www.darkreading.com/cyberattacks-data-breaches/busysnake-infostealer-critical-infrastructure-networks)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Farmored-likho-targets-critical-infrastructure%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Farmored-likho-targets-critical-infrastructure%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Farmored-likho-targets-critical-infrastructure%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Farmored-likho-targets-critical-infrastructure%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Farmored-likho-targets-critical-infrastructure%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Farmored-likho-targets-critical-infrastructure%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Vulnerabilities CISA Flags Two Actively Exploited SonicWall SMA1000 Vulnerabilities Sep 3, 2026](https://codekeeper.co/ticker/sonicwall-sma1000-cisa-exploited-vulnerabilities)

[Vulnerabilities Unpatched Steam Flaw Gives Local Windows Users SYSTEM Access Sep 18, 2026](https://codekeeper.co/ticker/steam-zero-day-escalation-risk)

[Data breaches Yorkshire's Brain Tumour Charity Caught in Beacon CRM Breach Aug 14, 2026](https://codekeeper.co/ticker/ybtc-data-breach-alert)

[FBI Agents Fear for Their Safety After Massive Data Breach Sep 28, 2026](https://codekeeper.co/ticker/shinyhunters-fbi-data-breach-threat)