Armored Likho Hits Government, Energy Sectors With BusySnake Stealer

**Executive Summary:** Kaspersky identifies a previously undocumented threat actor dubbed Armored Likho running an active spear-phishing campaign against government and electric power organizations in Russia, Kazakhstan, and Brazil that delivers a Python-based infostealer (BusySnake) via NSIS droppers and malicious LNKs; the malware harvests credentials, session tokens, cookies, screenshots and crypto wallets, implements persistence and reverse SSH, and the operators use AI-generated payloads to hinder attribution.