Armored Likho Targets Government and Power Sectors with Malware Attacks

Overview of Armored Likho Activities

Armored Likho, a newly identified threat actor, is deploying malware campaigns targeting government agencies and the electric power sector. The operations currently span Russia, Brazil, and Kazakhstan, posing significant cybersecurity threats to critical infrastructure.

Kaspersky conducted the technical analysis revealing that Armored Likho engages in both cyber espionage and financially motivated attacks, using sophisticated tooling, including the BusySnake Stealer and Go2Tunnel for remote access.

Tools and Techniques Used

The group's toolkit is diverse, featuring modular RATs and information stealers specifically designed to bypass dynamic analysis. The BusySnake Stealer, a Python-based malware, is a part of this arsenal, enabling the group to exfiltrate credentials and sensitive information stealthily.

Armored Likho uses spear-phishing for initial access, employing archives with executables or LNK files that download malware when opened. This technique helps them maintain prolonged access to compromised networks.

Potential Affiliations and Significance

There are possible overlaps between Armored Likho and the threat cluster known as Eagle Werewolf, active since May 2023, known for attacking government and defense entities involved in UAV development.

Understanding Armored Likho's operations is crucial for enhancing cybersecurity measures in affected regions, particularly in protecting critical infrastructure from similar threat actors.