Insights, news, education and announcements from PolySwarm

BusySnake Stealer: Inside Armored Likho's AI-Assisted Malware Operation

Jul 13, 2026 1:09:43 PM / by The Hivemind posted in Threat Bulletin, Infostealer, Spear Phishing, Python Malware, credential theft, Armored Likho, BusySnake Stealer, AI-assisted malware, Eagle Werewolf, reverse SSH tunnel

0 Comments

Verticals Targeted: Government, Electric, Energy, Critical Infrastructure
Regions Targeted: Russia, Kazakhstan, Brazil
Related Threat Actors: Armored Likho
Related Families: BusySnake

Executive Summary

Researchers have identified an active phishing campaign introducing a previously undocumented Python-based infostealer dubbed BusySnake Stealer. Targeting government agencies and electric power organizations across Russia, Kazakhstan, and Brazil, the campaign combines AI-assisted first-stage loaders, modular malware, GitHub-hosted payload delivery, and advanced credential theft capabilities. The operation demonstrates the group's continued technical evolution and highlights how increasingly modular malware can complicate traditional signature-based detection while reinforcing the importance of behavioral analytics and threat intelligence.

Threat Actors Exploit CVE-2025-3248 to Deliver Flodrix Botnet

Jun 27, 2025 2:34:57 PM / by The Hivemind posted in Threat Bulletin, CVE-2025-3248, AI Server Security, Cybersecurity Threats, Trend Micro, Flodrix Botnet, Langflow Vulnerability, Remote Code Execution, DDoS Attacks, Python Malware, Botnet Mitigation

0 Comments

Verticals Targeted: AI
Regions Targeted: Not specified
Related Families: LeetHozer

The PolySwarm Blog

BusySnake Stealer: Inside Armored Likho's AI-Assisted Malware Operation

Executive Summary

Threat Actors Exploit CVE-2025-3248 to Deliver Flodrix Botnet

Subscribe to Email Updates

Lists by Topic

Posts by Topic

Recent Posts

Join the Marketplace

For Enterprises and Businesses

For Security Experts and AV Companies