Armored Likho APT Deploys BusySnake Stealer Against Government and Power Sector Targets

A newly identified APT, Armored Likho (aka Eagle Werewolf), is conducting targeted spear-phishing against government and electric power organizations in Russia, Brazil, and Kazakhstan, using NSIS EXE droppers and malicious LNK shortcuts to deploy a Python-based infostealer (BusySnake) alongside RATs and tunneling tools; payloads are staged on GitHub and protected with PyArmor, and the actor employs persistence, scheduled tasks, continuous C2 polling, and AI-assisted loader generation to support credential and data exfiltration, posing a high risk to critical infrastructure and sensitive information.