Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
Armored Likho APT Uses AI-Generated Loaders to Deploy BusySnake Stealer Against Government Targets
Threat Actors
Excerpt
A newly identified threat group, tracked as Armored Likho and, based on circumstantial evidence, also known as Eagle Werewolf, is targeting government agencies and electric power organizations with phishing attacks and a new Python-based infostealer named BusySnake Stealer. The campaign has affected targets in Russia, Brazil, and Kazakhstan, highlighting the group’s growing reach and technical maturity. Researchers found that Armored Likho combines financially motivated…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | 5d5c3e483c5e544260ce98fc29fbf192 | Medium | Score 56/100 | First seen |
| MD5 | f5c6434ee5f7578faa3bc1257e1c9226 | Medium | Score 56/100 | First seen |
| MD5 | 7141917cba2eee2b4d31107faccf3a39 | Medium | Score 56/100 | First seen |
IOC Relationship Graph
Building graph…