APT Group 'Armored Likho' Hits Power Grids with New AI-Assisted Malware

Discover how the "Armored Likho" group uses AI-generated loaders in spear-phishing attacks on government and power sector targets in Russia, Brazil and Kazakhstan.

By Content Team

Jul 7, 2026

ON THIS PAGE

Kaspersky has documented a new weapon in the hands of Armored Likho, a threat group it has tracked before: a previously undocumented, Python-based infostealer called "BusySnake." The group is targeting government agencies and electrical power entities across Russia, Brazil and Kazakhstan with spear-phishing emails disguised as official government or social assistance communications.

BusySnake steals browser passwords and cookies, clipboard contents, cryptographic keys, and Telegram session data, and opens backdoor access through reverse SSH tunnels and remote-access software. It consolidates into one tool what the group previously ran as separate components, including its Go2Tunnel utility.

Kaspersky also sees the group leaning on AI to build its first-stage loaders — inferred from redundant comments and code blocks atypical of human developers, rather than from any recovered tooling. The group's nation-state affiliation remains unconfirmed.

Source: Dark Reading

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?