Armored Likho Threat Actor: Detecting BusySnake Stealer in Critical Infrastructure

A newly discovered threat actor named Armored Likho has been actively targeting government agencies and the electric power sector in Russia, Brazil, and Kazakhstan. According to a technical analysis by Kaspersky, this group is particularly concerning because they blend financially motivated campaigns against individuals with targeted cyber espionage operations against organizations. The threat actor employs a previously undocumented malware called BusySnake Stealer, which poses significant risks to critical infrastructure and government operations. Given the focus on critical sectors, security teams must urgently implement detection mechanisms and defensive measures.

Technical Analysis

The Armored Likho threat actor represents a sophisticated group operating in 2026, specifically targeting:

Government agencies
Electric power sector organizations
Geographic regions: Russia, Brazil, and Kazakhstan

The primary weapon in their arsenal is the BusySnake Stealer malware, which serves as an information-gathering tool. This malware is designed to steal sensitive data from infected systems, including:

Credentials and authentication tokens
System information
Sensitive documents
Configuration files

The attack vector typically begins with phishing campaigns or social engineering approaches to deliver the BusySnake Stealer payload. Once executed on a target system, the malware establishes persistence and begins exfiltrating data to command and control (C2) infrastructure operated by Armored Likho.

What makes this threat particularly concerning is the dual nature of their operations - they conduct both financially motivated attacks against individuals and targeted espionage against organizations. This hybrid approach suggests the threat actor has both criminal and potentially state-sponsored motivations.

Detection & Response

SIGMA Rules

YAML

---
title: BusySnake Stealer - Suspicious Process Execution
id: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects execution patterns associated with BusySnake Stealer malware used by Armored Likho threat actor
references:
  - https://attack.mitre.org/techniques/T1055/
  - https://attack.mitre.org/techniques/T1003/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.defense_evasion
  - attack.credential_access
  - attack.t1055
  - attack.t1003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - '\Temp\'
      - '\AppData\Local\Temp\'
    CommandLine|contains:
      - 'powershell -EncodedCommand'
      - 'rundll32.exe'
      - 'regsvr32.exe'
  condition: selection
falsepositives:
  - Legitimate administrative activity
  - System maintenance tasks
level: high
---
title: Armored Likho - Suspicious Network Connection
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects suspicious network connections associated with Armored Likho C2 infrastructure
references:
  - https://attack.mitre.org/techniques/T1071/
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.command_and_control
  - attack.exfiltration
  - attack.t1071
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort|startswith:
      - '44'
    Initiated: 'true'
    Image|contains:
      - '\Temp\'
      - '\AppData\Local\Temp\'
  condition: selection
falsepositives:
  - Legitimate cloud services
  - Encrypted web traffic
level: medium
---
title: BusySnake Stealer - Data Exfiltration Indicators
id: 8b4e2d93-0f5c-4e4b-a9d6-2f6a9c0a2345
status: experimental
description: Detects file access patterns consistent with BusySnake Stealer data collection
references:
  - https://attack.mitre.org/techniques/T1005/
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.collection
  - attack.exfiltration
  - attack.t1005
  - attack.t1560
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\AppData\Roaming\Microsoft\Credentials\'
      - '\AppData\Local\Google\Chrome\User Data\Default\Cookies'
      - '\AppData\Local\Mozilla\Firefox\Profiles\'
    Image|contains:
      - '\Temp\'
      - '\AppData\Local\Temp\'
  condition: selection
falsepositives:
  - Legitimate browser operations
  - Credential manager access
level: high

KQL for Microsoft Sentinel/Defender

KQL — Microsoft Sentinel / Defender

// Hunt for BusySnake Stealer process execution patterns
let SuspiciousProcesses = materialize(
    DeviceProcessEvents
    | where Timestamp > ago(30d)
    | where FolderPath has @"Temp\" or FolderPath has @"AppData\Local\Temp\"
    | where ProcessCommandLine has any("powershell -EncodedCommand", "rundll32.exe", "regsvr32.exe")
);
SuspiciousProcesses
| summarize Count=count() by DeviceName, ProcessVersionInfoCompanyName, AccountName
| where Count > 5
| project DeviceName, ProcessVersionInfoCompanyName, AccountName, Count
| sort by Count desc

// Hunt for network connections to potential C2 infrastructure
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemotePort hasprefix "44"
| where InitiatingProcessFolderPath has @"Temp\" or InitiatingProcessFolderPath has @"AppData\Local\Temp\"
| summarize Count=count() by DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName
| where Count > 3
| project DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, Count
| sort by Count desc

// Hunt for credential and sensitive file access
DeviceFileEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFolderPath has @"Temp\" or InitiatingProcessFolderPath has @"AppData\Local\Temp\"
| where TargetFileName has_any(@"AppData\Roaming\Microsoft\Credentials\", 
                                @"AppData\Local\Google\Chrome\User Data\Default\Cookies",
                                @"AppData\Local\Mozilla\Firefox\Profiles\")
| summarize Count=count() by DeviceName, InitiatingProcessFileName, AccountName
| where Count > 3
| project DeviceName, InitiatingProcessFileName, AccountName, Count
| sort by Count desc

Velociraptor VQL

VQL — Velociraptor

-- Hunt for BusySnake Stealer process execution patterns
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ 'Temp\\' OR Exe =~ 'AppData\\Local\\Temp\\'
   AND (CommandLine =~ 'powershell -EncodedCommand' 
        OR CommandLine =~ 'rundll32.exe' 
        OR CommandLine =~ 'regsvr32.exe')

-- Hunt for suspicious network connections associated with BusySnake Stealer
SELECT Fd, Family, RemoteAddress, RemotePort, State, Pid, StartTime
FROM netstat()
WHERE RemotePort >= 44000 AND RemotePort < 45000
   AND Pid IN (SELECT Pid FROM pslist() 
               WHERE Exe =~ 'Temp\\' OR Exe =~ 'AppData\\Local\\Temp\\')

-- Hunt for credential and sensitive file access patterns
SELECT FullPath, Size, Mtime, Atime, Mode
FROM glob(globs='/*')
WHERE FullPath =~ 'AppData\\Roaming\\Microsoft\\Credentials\\'
   OR FullPath =~ 'AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies'
   OR FullPath =~ 'AppData\\Local\\Mozilla\\Firefox\\Profiles\\'

Remediation Script (PowerShell)

PowerShell

# BusySnake Stealer Detection and Remediation Script
# Run with administrator privileges

function Check-ForBusySnakeIndicators {
    # Check for suspicious processes
    $suspiciousProcesses = Get-Process | Where-Object { 
        $_.Path -match 'Temp\|AppData\Local\Temp\' -and 
        ($_.ProcessName -match 'powershell|wscript|cscript|rundll32' -or 
         $_.CommandLine -match 'EncodedCommand') 
    }
    
    if ($suspiciousProcesses) {
        Write-Host "ALERT: Suspicious processes detected:" -ForegroundColor Red
        $suspiciousProcesses | Format-Table Id, ProcessName, Path, StartTime -AutoSize
        
        # Terminate suspicious processes
        foreach ($process in $suspiciousProcesses) {
            Write-Host "Terminating process: $($process.ProcessName) (ID: $($process.Id))" -ForegroundColor Yellow
            Stop-Process -Id $process.Id -Force -ErrorAction SilentlyContinue
        }
    } else {
        Write-Host "No suspicious processes detected." -ForegroundColor Green
    }
    
    # Check for suspicious scheduled tasks
    Write-Host "`nChecking for suspicious scheduled tasks..." -ForegroundColor Cyan
    $suspiciousTasks = Get-ScheduledTask | Where-Object { 
        $_.TaskPath -notmatch 'Microsoft\' -and 
        $_.Actions.Execute -match 'Temp\|AppData\Local\Temp\' 
    }
    
    if ($suspiciousTasks) {
        Write-Host "ALERT: Suspicious scheduled tasks detected:" -ForegroundColor Red
        $suspiciousTasks | Format-Table TaskName, TaskPath, State -AutoSize
        
        # Disable suspicious tasks
        foreach ($task in $suspiciousTasks) {
            Write-Host "Disabling task: $($task.TaskName)" -ForegroundColor Yellow
            Disable-ScheduledTask -TaskName $task.TaskName -TaskPath $task.TaskPath -ErrorAction SilentlyContinue
        }
    } else {
        Write-Host "No suspicious scheduled tasks detected." -ForegroundColor Green
    }
    
    # Check for persistence mechanisms
    Write-Host "`nChecking for persistence mechanisms in registry..." -ForegroundColor Cyan
    $runKeys = @(
        "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
        "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
        "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
        "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce"
    )
    
    $suspiciousRegistryEntries = foreach ($key in $runKeys) {
        if (Test-Path $key) {
            Get-ItemProperty -Path $key -ErrorAction SilentlyContinue | 
            Get-Member -MemberType NoteProperty | 
            Where-Object { $_.Name -ne "PSPath" -and $_.Name -ne "PSParentPath" -and $_.Name -ne "PSChildName" } |
            ForEach-Object {
                $value = (Get-ItemProperty -Path $key).$($_.Name)
                if ($value -match 'Temp\|AppData\Local\Temp\') {
                    [PSCustomObject]@{
                        Key = $key
                        Name = $_.Name
                        Value = $value
                    }
                }
            }
        }
    }
    
    if ($suspiciousRegistryEntries) {
        Write-Host "ALERT: Suspicious registry entries detected:" -ForegroundColor Red
        $suspiciousRegistryEntries | Format-Table Key, Name, Value -AutoSize
        
        # Remove suspicious entries
        foreach ($entry in $suspiciousRegistryEntries) {
            Write-Host "Removing registry entry: $($entry.Name) from $($entry.Key)" -ForegroundColor Yellow
            Remove-ItemProperty -Path $entry.Key -Name $entry.Name -ErrorAction SilentlyContinue
        }
    } else {
        Write-Host "No suspicious registry entries detected." -ForegroundColor Green
    }
}

function Harden-SystemAgainstBusySnake {
    Write-Host "`nHardening system against BusySnake Stealer..." -ForegroundColor Cyan
    
    # Enable PowerShell Script Block Logging
    Write-Host "Enabling PowerShell Script Block Logging..." -ForegroundColor Yellow
    $registryPath = "HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
    if (-not (Test-Path $registryPath)) {
        New-Item -Path $registryPath -Force | Out-Null
    }
    Set-ItemProperty -Path $registryPath -Name "EnableScriptBlockLogging" -Value 1 -Force
    
    # Disable WMI Persistence
    Write-Host "Restricting WMI event subscriptions..." -ForegroundColor Yellow
    $wmiPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy"
    if (-not (Test-Path $wmiPath)) {
        New-Item -Path $wmiPath -Force | Out-Null
    }
    Set-ItemProperty -Path $wmiPath -Name "EnableScheduledTasks" -Value 0 -Force -ErrorAction SilentlyContinue
    
    # Harden browser security settings
    Write-Host "Hardening browser security settings..." -ForegroundColor Yellow
    $chromePath = "HKLM:\SOFTWARE\Policies\Google\Chrome"
    if (-not (Test-Path $chromePath)) {
        New-Item -Path $chromePath -Force | Out-Null
    }
    Set-ItemProperty -Path $chromePath -Name "PasswordManagerEnabled" -Value 0 -Force -ErrorAction SilentlyContinue
    
    # Enable Defender Advanced Threat Protection
    Write-Host "Enabling Microsoft Defender ATP protections..." -ForegroundColor Yellow
    Set-MpPreference -EnableNetworkProtection Enabled -ErrorAction SilentlyContinue
    Set-MpPreference -PUAProtection Enabled -ErrorAction SilentlyContinue
    Set-MpPreference -AttackSurfaceReductionRules_Ids 01443614-cd74-433a-b99e-2ecdc07bfc25 -AttackSurfaceReductionRules_Actions Enabled -ErrorAction SilentlyContinue
    
    Write-Host "`nSystem hardening completed." -ForegroundColor Green
}

# Execute detection and remediation
Check-ForBusySnakeIndicators
Harden-SystemAgainstBusySnake

Write-Host "`nBusySnake Stealer detection and remediation completed. Please review alerts and continue monitoring." -ForegroundColor Green

Remediation

To protect against Armored Likho and BusySnake Stealer, organizations should implement the following defensive measures:

Immediate Actions:
- Implement the detection rules provided above across your security stack
- Conduct a hunt for existing indicators of compromise using the provided queries
- Isolate any systems showing signs of infection pending forensic analysis
User Awareness:
- Educate employees about phishing techniques, particularly those targeting credentials
- Implement email filtering to detect and block phishing campaigns
- Encourage users to verify unexpected requests for sensitive information
Endpoint Protection:
- Deploy advanced endpoint detection and response (EDR) solutions
- Enable script block logging and PowerShell transcription
- Restrict execution of scripts from temporary directories
- Implement application whitelisting where feasible
Network Security:
- Monitor and restrict outbound connections to suspicious domains
- Implement DNS filtering to prevent connections to known C2 infrastructure
- Enforce network segmentation for critical systems
- Use proxy servers with SSL inspection for outbound traffic
Access Controls:
- Enforce the principle of least privilege for user accounts
- Implement multi-factor authentication for all remote access
- Regularly review and update access permissions
- Use privileged access workstations for administrative tasks
Vulnerability Management:
- Keep all systems and applications fully patched
- Prioritize patches for common attack vectors
- Conduct regular vulnerability assessments of critical systems
Incident Response:
- Develop specific playbooks for data-stealing malware incidents
- Establish clear lines of communication for potential attacks
- Conduct tabletop exercises focused on credential theft scenarios
- Review and update incident response plans regularly
Compliance:
- Ensure alignment with NIST CSF, CIS Controls, and industry-specific requirements
- Document all implemented security controls and procedures
- Conduct regular security assessments and penetration testing

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub