Two distinct credential theft campaigns have been identified in today's threat landscape. The APT group Armored Likho has launched a sophisticated spear-phishing campaign targeting government agencies and electric power sectors in Russia, Brazil, and Kazakhstan using a newly documented Python-based infostealer called BusySnake Stealer. Concurrently, a sprawling ecosystem of phishing operations is targeting children through popular gaming platforms (Roblox and Minecraft), using credential harvesting, offerwall schemes, and subscription traps to monetize young users' data. While the campaigns differ in sophistication and targeting, both ultimately seek credential theft and data harvesting for financial and espionage purposes.
Threat Actor / Malware Profile
Armored Likho APT Group
Armored Likho is an advanced persistent threat group with capabilities spanning from credential theft to full remote access. Their recent campaign demonstrates:
Distribution Method: Spear-phishing emails containing malicious executable (EXE) files or LNK shortcuts tailored to government and energy sector victims.
BusySnake Stealer: A Python-based infostealer featuring:
- Advanced obfuscation using PyArmor to evade static analysis
- Browser password extraction capabilities
- Credential theft from multiple applications
- Data exfiltration capabilities
AquilaRAT: Remote access trojan component providing:
- Remote control capabilities
- System reconnaissance
- Secondary payload deployment
Go2Tunnel: A reverse SSH tunneling tool that:
- Establishes persistent C2 channels
- Bypasses network perimeter defenses
- Facilitates lateral movement
Persistence Mechanism: Likely established through scheduled tasks or registry modifications (common for Python-based malware).
Anti-Analysis Techniques:
- PyArmor obfuscation to prevent reverse engineering
- Potential environment checks to detect sandboxes
C2 Communication: Encrypted traffic to command and control servers, potentially using HTTP/HTTPS protocols for blending with normal traffic.
Children's Gaming Platform Phishing Operation
Target: Children using Roblox and Minecraft platforms, particularly in educational environments.
Attack Vector: Fraudulent websites mimicking official gaming platforms, using:
- Typosquatting domains (e.g., roblox-com.com)
- Subdomain deception (e.g., www-roblox.pw)
- Lookalike domains (e.g., robiox.com.ua variations)
Malicious Activities:
- Offering fake free in-game currency (offerwall schemes)
- Requesting account credentials
- Enrolling minors in paid subscription services
- Harvesting personal information
- Violating platform terms of service to cause account bans
IOC Analysis
The pulse data includes the following indicator types:
Domains:
- lvl99.store (BusySnake C2)
- Numerous typosquatting gaming domains (roblox-com.com, blox.ink, etc.)
File Hashes: Multiple MD5, SHA1, and SHA256 hashes for BusySnake Stealer variants and associated malware.
Hostnames:
- www.robiox.com.ua (fraudulent gaming site)
Operationalization Guidance:
- Domains should be blocked at DNS resolvers and proxy servers
- File hashes should be integrated into EDR alerts and antivirus signatures
- YARA rules should be created to detect PyArmor-obfuscated Python samples
- Network monitoring should focus on identifying connections to these domains and analyzing potential C2 traffic patterns
Tooling Recommendations:
- Splunk or ELK for log analysis and correlation
- MISP or ThreatConnect for IOC management
- VirusTotal for hash analysis
- Malware analysis sandboxes for dynamic analysis of suspicious files
Detection Engineering
Sigma Rules
---
title: BusySnake Stealer Execution
id: 8a1d7f2e-4c5b-4520-9e8a-f5c1b3d4e6f8
description: Detects potential execution of BusySnake Stealer based on Python processes with suspicious arguments
author: Security Arsenal
date: 2026/08/02
status: stable
references:
- https://securelist.com/tr/armored-likho-apt-with-busysnake-stealer/120292/
tags:
- attack.execution
- attack.credential_access
- detection.emerging_threats
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: '\python.exe'
CommandLine|contains:
- 'busy'
- 'steal'
- 'browser'
- 'credential'
condition: selection
falsepositives:
- Legitimate Python scripts with similar names (unlikely)
level: high
---
title: Malicious Gaming Domain Connection
id: 3d4a8b1c-7e6f-4a2b-9c0d-1e2f3a4b5c6d
description: Detects connections to known malicious domains targeting gaming platforms
author: Security Arsenal
date: 2026/08/02
status: stable
references:
- https://censys.com/blog/roblox-minecraft-and-the-insidious-internet-for-children/
tags:
- attack.command_and_control
- attack.initial_access
- detection.emerging_threats
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationHostname|contains:
- 'roblox-com.com'
- 'blox.ink'
- 'bloxlink.net'
- 'bloxlink.site'
- 'www-roblox.pw'
- 'robiox.com'
condition: selection
falsepositives:
- False positives possible but unlikely given the specificity of domain patterns
level: high
---
title: Armored Likho C2 Domain Connection
id: 7a5b9c1d-2e3f-4a5b-9c0d-1e2f3a4b5c6d
description: Detects connections to known C2 infrastructure associated with Armored Likho
author: Security Arsenal
date: 2026/08/02
status: stable
references:
- https://securelist.com/tr/armored-likho-apt-with-busysnake-stealer/120292/
tags:
- attack.command_and_control
- attack.exfiltration
- detection.emerging_threats
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationHostname|contains: 'lvl99.store'
condition: selection
falsepositives:
- Legitimate connections to this domain are highly unlikely
level: critical
KQL Hunt Queries
// Hunt for connections to known malicious domains
DeviceNetworkEvents
| where RemoteUrl has_any ("roblox-com.com", "blox.ink", "bloxlink.net", "bloxlink.site", "www-roblox.pw", "robiox.com", "lvl99.store")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| order by Timestamp desc
// Hunt for Python processes with suspicious characteristics
DeviceProcessEvents
| where ProcessVersionInfoProductName contains "Python"
| where ProcessCommandLine has_any ("busy", "steal", "credential", "browser", "password")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, ProcessIntegrityLevel
| order by Timestamp desc
// Look for credential access indicators
SecurityEvent
| where EventID == 4663 and ObjectType == "SECRET"
| project Timestamp, Computer, Account, SubjectUserName, ObjectName, AccessMask
| order by Timestamp desc
PowerShell IOC Hunt Script
# IOC Hunt Script for BusySnake Stealer and Gaming Platform Phishing
# Known file hashes
$maliciousHashes = @(
"8a100cbdf79231e70cee2364ebd9a4433fda6b4de4929d705f26f7b68d6aeb79",
"393b498f2114cabc0b29d5fcd9dc6723",
"a0b80c0ec77f62b0ed46edb3fef05ccb88c74afb",
"0041fd1b2358cd08dbcbc28ea8fc3d20",
"006887732ca4a4a46a97989cf4deeef6",
"07213c419489c02791e8d67b91e404ef",
"1096268fa2b3d454c86cf851cb782319"
)
# Known malicious domains
$maliciousDomains = @(
"lvl99.store",
"roblox-com.com",
"blox.ink",
"bloxlink.net",
"bloxlink.site",
"www-roblox.pw",
"robiox.com.ua",
"robiox.com.ps"
)
# Check for files with matching hashes
Write-Host "Checking for malicious files..." -ForegroundColor Yellow
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue |
Where-Object { $_.Length -gt 0 } |
ForEach-Object {
$hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
if ($maliciousHashes -contains $hash) {
Write-Host "ALERT: Malicious file found: $($_.FullName)" -ForegroundColor Red
}
}
# Check DNS cache for malicious domains
Write-Host "Checking DNS cache for malicious domains..." -ForegroundColor Yellow
Get-DnsClientCache |
Where-Object { $maliciousDomains -contains $_.Entry } |
ForEach-Object {
Write-Host "ALERT: Malicious domain found in DNS cache: $($_.Entry) -> $($_.Data)" -ForegroundColor Red
}
# Check browser history for malicious domains (Chrome example)
$chromeHistoryPath = "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\History"
if (Test-Path $chromeHistoryPath) {
Write-Host "Checking Chrome history for malicious domains..." -ForegroundColor Yellow
# Chrome history is SQLite; would need specialized tool to parse
Write-Host "Chrome history found at $chromeHistoryPath - requires SQLite parsing" -ForegroundColor Cyan
}
# Check for suspicious scheduled tasks
Write-Host "Checking for suspicious scheduled tasks..." -ForegroundColor Yellow
Get-ScheduledTask |
Where-Object { $_.TaskName -match "python" -or $_.TaskName -match "busy" -or $_.TaskName -match "steal" } |
ForEach-Object {
Write-Host "ALERT: Suspicious scheduled task: $($_.TaskName)" -ForegroundColor Red
}
# Check for suspicious processes
Write-Host "Checking for suspicious processes..." -ForegroundColor Yellow
Get-Process |
Where-Object { $_.ProcessName -match "python" } |
ForEach-Object {
$cmdLine = (Get-CimInstance Win32_Process -Filter "ProcessId = $($_.Id)").CommandLine
if ($cmdLine -match "busy|steal|credential|browser|password") {
Write-Host "ALERT: Suspicious Python process: $($_.Id) with command line: $cmdLine" -ForegroundColor Red
}
}
Write-Host "IOC hunt complete." -ForegroundColor Green
Response Priorities
Immediate (0-24 hours)
- Block all IOC domains at DNS and perimeter firewall level
- Deploy new EDR signatures for BusySnake Stealer file hashes
- Scan email gateways for spear-phishing campaigns targeting government/energy sectors
- Initiate hunt for file hashes on critical systems
24 Hours
- Force password reset for all accounts that may have been compromised by credential stealers
- Conduct targeted hunting for BusySnake Stealer persistence mechanisms
- Review network logs for historical connections to malicious domains
- Implement DNS sinkholing for malicious gaming domains to capture victim IPs
1 Week
- Implement advanced email filtering for spear-phishing targeting government/energy sectors
- Deploy application whitelisting for Python interpreters on critical systems
- Create user awareness training focused on credential theft attacks
- Enhance monitoring for browser credential theft activities
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.