Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer

**Armored Likho** is a sophisticated threat actor conducting targeted espionage and financially motivated operations against government and electric‑power sector targets in Russia, Brazil, and Kazakhstan, using modular, obfuscated RATs and a Python infostealer called BusySnake; attacks begin with spear‑phishing (RAR/EXE or LNK exploiting CVE-2025-9491), establish persistence via VBScript and scheduled tasks, and leverage Go2Tunnel/RustDesk for remote access and data exfiltration.