BusySnake Stealer Uses Reverse SSH Tunnels and AI-Generated Loaders to Evade Detection

Armored Likho, a previously undocumented threat group also tracked as Eagle Werewolf based on circumstantial evidence, is targeting government institutions and electric-power organizations across Russia, Brazil, and Kazakhstan with a new Python-based infostealer named BusySnake.

The group’s activity reflects an unusual overlap between cyber-espionage and financially motivated operations.

Armored Likho targets organizations for intelligence collection while also pursuing browser credentials, cryptocurrency wallet files, Telegram session data, cookies, and two-factor authentication secrets that can be monetized or reused for broader intrusion activity.

Initial access begins with phishing emails themed around official notices, humanitarian aid applications, debt-clearance certificates, and psychological tests.

Malicious ZIP or RAR attachments contain either executable droppers or LNK shortcut files crafted to match the lure. In one observed chain, an NSIS self-extracting executable launches a decoy psychological survey while injecting a malicious loader into a legitimate process.

The loader retrieves payload archives from attacker-controlled GitHub repositories, highlighting the continued abuse of legitimate development platforms for malware distribution and rapid payload rotation.

The archive installs a Python 3.123.123.12 runtime, pip dependencies, PyArmor components, and the BusySnake payload in the %AppData%\WindowsHelper directory. Persistence is established through VBScript and a scheduled task configured to execute the stealer every five minutes.

Securelist Researchers said that, the active campaign combines spear-phishing, AI-generated loader code, reverse SSH tunneling, and modular credential theft capabilities to evade analysis and retain access to compromised Windows systems.

BusySnake Stealer Uses Reverse SSH

A separate infection path abuses the Windows LNK display issue tracked as ZDI-CAN-25373. The flaw enables attackers to obscure command-line parameters using spaces and line breaks.

When activated, the shortcut launches an obfuscated PowerShell command that downloads the next-stage loader and displays a benign document to reduce user suspicion.

Researchers found that several first-stage loaders feature unusually verbose comments and emoji-based lists, characteristics suggesting they were generated or heavily assisted by large language models.

This use of AI complicates attribution because commodity-looking code can be quickly rewritten, repackaged, and customized without retaining the coding patterns traditionally used to link malware to an operator.

BusySnake itself is protected with PyArmor Pro 9.2.09.2.09.2.0, which decrypts Python bytecode only when a function executes and re-encrypts it afterward.

The stealer also runs through a .pyw file, suppressing the console window and reducing visibility to victims.

Its modules inventory files, log clipboard contents, capture screenshots, identify 646464-character hexadecimal keys, and exfiltrate documents from Desktop, Documents, and Downloads folders.

The malware can decrypt credentials stored by Chromium-based browsers through Windows DPAPI and recover Firefox credentials through the PK11SDR_Decrypt function.

It also steals browser cookies directly from local databases or deploys a supplementary module that installs a malicious browser extension. The extension relays harvested cookie data to a locally hosted server before the data is forwarded to the command-and-control infrastructure.

Most notably, BusySnake can establish a reverse SSH tunnel after receiving an SSH command and private key from its command server.

This capability allows operators to bypass network restrictions, create an encrypted route into a victim environment, and remotely pivot through the compromised endpoint. The implant can also install or manipulate RustDesk to support interactive remote access.

Security teams should monitor for scheduled tasks and VBScript launchers associated with %AppData%\WindowsHelper, unexpected Python runtime deployments, suspicious GitHub-hosted archives, unusual browser extension installations, and outbound SSH activity from endpoints that do not normally use it.

The campaign demonstrates how modular malware, AI-assisted development, and trusted cloud services are converging to make phishing-led intrusion chains more adaptable and harder to detect.

Stop Accepting SLAs Written for 2019 SOCs – Here’s the 2026 AI SLA Vendor Checklist – Download Free AI SOC SLA Guide