← threat actors
threat actor
Armored Likho
4 stories · 3 in the wild · July 4, 2026 – August 22, 2026
evidence: 3 observed · 1 disclosed
sectors
- energy 2 · Jul 5
- government 2 · Jul 5
- consumers 1 · Aug 15
geography
- russia 3 · Aug 15
- brazil 2 · Jul 5
- kazakhstan 2 · Jul 5
malware and tools
- busysnake 3 · Aug 22
- kharon 1 · Aug 22
- still audio 1 · Aug 15
- still sync 1 · Aug 15
attack phases seen
- Collection 3 · Aug 15
- Execution 1 · Jul 4
what we reported, newest first, grouped by story
Aug 15 – August 22, 2026 · 2 reports
- Armored Likho has rewritten BusySnake in Golang and adopted the open-source Kharon RAT, while moving C2 and payload hosting off public GitHub to private GitLab and GitHub repos to frustrate analysis and blend with normal developer traffic. LLM-generated loaders remain part of their toolchain (@blackorbird) (earlier coverage).
· Aug 22 · observed · Threat Activity
- Armored Likho expanded its espionage toolkit with a Rust/Tauri dropper fronted by a fake catalog, plus "Still Sync" for Telegram data theft and "Still Audio" for voice surveillance, targeting Russian users (Securelist).
· Aug 15 · disclosed · Threat Activity
Jul 4 – July 5, 2026 · 2 reports
- Armored Likho targets government and electric-power organizations across Russia, Brazil, and Kazakhstan with the BusySnake stealer, blending financially motivated activity with espionage. The Hacker News
· Jul 5 · observed · Threat Activity
- Armored Likho deploys BusySnake Stealer. Kaspersky attributed a global, Python-based obfuscated malware campaign — blending financially motivated and espionage activity — to government and power-sector targets in Russia, Brazil, and Kazakhstan. Securelist
· Jul 4 · observed · Threat Intelligence