Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign

**Executive summary:** The report describes an active, targeted phishing campaign by an APT actor dubbed Armored Likho that uses AI-generated first-stage loaders and a previously undocumented Python infostealer (BusySnake Stealer) to compromise government and electric power sector organizations in Russia, Brazil, and Kazakhstan; the malware exfiltrates credentials, cookies, screenshots and files, supports reverse SSH tunneling for persistent remote access, uses PyArmor-based obfuscation and in-memory execution to evade detection, and includes numerous IOCs and C2 domains/IPs for detection and response.