Armored Likho APT Targets Power Grids with BusySnake Stealer Malware

Armored Likho is an active APT conducting spear-phishing campaigns against government and electric power organizations in Russia, Brazil, and Kazakhstan, deploying a stealthy infostealer called BusySnake Stealer and exploiting CVE-2025-9491; immediate patching and auditing of scheduled tasks are recommended to mitigate ongoing risk.