Armored Likho Hackers Hit Power Grids with BusySnake Malware

Robert Moore · 2026-07-03

A newly uncovered threat actor, Armored Likho, is making headlines for launching cyberattacks against government agencies and electric power companies. The group has been active across Russia, Brazil, and Kazakhstan, and security researchers are just now piecing together their methods. Armored Likho isn't your average hacker crew. According to Kaspersky's latest report, they mix financially motivated attacks on regular people with targeted espionage against big organizations. That's a dangerous combo, and it means they're after everything from your personal bank account to national security secrets. ### What Makes Armored Likho Different? Most cybercriminal groups stick to one lane. Some are after money, others are after intel. But Armored Likho does both. They use a custom malware called BusySnake Stealer, which is designed to siphon credentials, files, and other sensitive data from infected systems. Think of it like a thief who breaks into your house to steal your TV, but also checks your mail for credit card offers. That dual-purpose approach makes them harder to track and stop. ### Who's in the Crosshairs? The attacks have hit three main regions: - Government agencies in Russia - Electric power sector in Brazil - Government and energy targets in Kazakhstan These aren't random choices. Power grids and government networks are high-value targets. If Armored Likho gets in, they could disrupt critical infrastructure or steal classified information. ### How BusySnake Stealer Works BusySnake isn't flashy, but it's effective. It spreads through phishing emails and malicious downloads. Once inside, it quietly collects data and sends it back to the attackers. Here's the scary part: it can stay hidden for weeks or months before anyone notices. Kaspersky's analysis shows the malware is constantly evolving. The developers add new features to avoid detection, like encrypting its traffic and using legitimate services for command-and-control. ### What This Means for You If you work in government or energy, this is a wake-up call. But even regular folks should pay attention. Armored Likho's financial campaigns target individuals too. That means phishing emails, fake websites, and other tricks could land on your doorstep. Here are a few things you can do to stay safe: - Never click on links or open attachments in unsolicited emails - Use strong, unique passwords for every account - Enable two-factor authentication wherever possible - Keep your software and antivirus up to date ### The Bigger Picture Armored Likho is just one example of how cyber threats are getting more sophisticated. Attackers are blending tactics, targeting both people and organizations, and using custom malware that's hard to detect. The days of simple viruses are long gone. Security experts recommend a layered defense. That means firewalls, endpoint protection, and employee training all working together. No single tool can stop every attack, but a strong strategy can minimize the damage. ### Final Thoughts Armored Likho isn't going away anytime soon. As long as there's money and secrets to steal, they'll keep evolving. The best defense is awareness. Stay informed, stay cautious, and don't let your guard down. If you want to dive deeper, check out Kaspersky's full report. It's a sobering read, but it's worth your time if you care about cybersecurity.