Armored Likho APT uses AI-made malware to steal data
The Armored Likho hacker group uses AI to create custom malware that steals data from victims. Their tools include a Python-based data stealer and a network tunneling tool called Go2Tunnel.
- Report priority
- Medium
- Targets
- Go2Tunnel
How it works
The hacker group sends malicious files or links that install their AI-generated malware, which steals data and lets them control infected computers remotely.
What to do
Check if you've opened a suspicious email or file recently, or if your computer behaves strangely.
Delete any suspicious files immediately, scan your computer with trusted antivirus software, and report the incident to your IT security team or local cybercrime authorities.
Technical details
A victim clicks a fake invoice email with a malicious Word document. The document uses AI-generated tricks to install BusySnake, a Python-based stealer that grabs passwords and files. The malware then opens a hidden network tunnel called Go2Tunnel to send stolen data back to the attackers.
Kaspersky tracks Armored Likho delivering a Python-based infostealer, BusySnake Stealer, through NSIS-built EXE droppers or weaponized LNK shortcut files. The Python code shows signs of AI generation, such as redundant comments and code blocks, which changes its structure enough to complicate attribution to the group. BusySnake logs clipboard contents, harvests browser cookies, pulls Telegram session tokens, scrapes two-factor authentication secrets, searches for cryptocurrency wallets, and takes screenshots, exfiltrating data over a reverse SSH tunnel now built into the stealer itself rather than the separate Go2Tunnel tool it used before. Payloads are staged from a GitHub repository, and VBScript helpers erase execution traces and set persistence via a scheduled task.