THREAT OPS › Threat News › Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign
Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign
<p><img alt="" class="attachment-securelist-huge-promo size-securelist-huge-promo wp-post-image" height="400" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2026/06/30105924/armored-likho-busysnake-featured-image-scaled-1-990x400.jpg" width="990" /></p><h2 id="introduction">Introduction</h2> <p>During our routine threat monitoring, we uncovered a new phishing campaign tied
Attributed threat actors
MITRE ATT&CK techniques
Indicators of compromise
- 5d5c3e483c5e544260ce98fc29fbf192md5
- 7141917cba2eee2b4d31107faccf3a39md5
- f5c6434ee5f7578faa3bc1257e1c9226md5
- c019797a00fd56edb1f468ac0a598510md5
- a0ec7a8e61eff3f445a7455b3aef9fbbmd5
- 7db9c688c620e54e8c69b7e52a7579fbmd5
- 90378881856abfa47d7745c0a3ef9dc8md5
- 1dba3e505491a260a44c867902c3296emd5
- 1096268fa2b3d454c86cf851cb782319md5
- f2ab09d7e7a375a192508a5014aa2ee4md5
- 0041fd1b2358cd08dbcbc28ea8fc3d20md5
- 894332174f536c2e1efeda05cba79f8bmd5
- 78135f72ab148a0cc074f6b2dd51fff6md5
- 07213c419489c02791e8d67b91e404efmd5
- 393b498f2114cabc0b29d5fcd9dc6723md5
- cf74ac018d158ea2c2cfa1b1d71d95bcmd5
- 2dfa1d949872c1b2f04952dd3e5f5d8fmd5
- c7622a1effa27bbfee6d6e03d6474343md5
- 80b7700053e115d65365ce7330383320md5
- 6b45ddb39a6e86229348dcbba3857e7cmd5
- 006887732ca4a4a46a97989cf4deeef6md5
- 732c31acf971a81c7e51b2a3dae82020md5
- ddff82a115558584bbd7741d4ffb35b4md5
- 8188b2f347b77d65d08cfb23808ac244md5
- e2550cfad9dcc880bf04f6048f90868cmd5
- fd2bdd8047addee6fde2f532de181bfdmd5
- http://127.0.0.1:8000/?data_type=curl
- https://grked.online/tunnel/create/?username=url
- http://grked.online:8000/tunnel/create/?username=url
- https://www.kaspersky.com/enterprise-security/endpoint-detection-response-edr?icid=gl_sl_post-kedr-expert_sm-team_29dc1130f3f612f2url
- https://tip.kaspersky.com/landscape/hunts/0aa195bc-98d6-edf4-c78a-d6e1f6dda337?icid=gl_sl_tip-rule-lnk_sm-team_156fcfa3aec1bc7curl
- https://tip.kaspersky.com/landscape/hunts/47b3ef0b-2dcc-fd14-f724-95d93f65e465?icid=gl_sl_tip-rule-lnk_sm-team_c01be301c2784335url
- https://tip.kaspersky.com/landscape/hunts/0971a329-51da-0fc4-67d1-3e0cc0f3725f?icid=gl_sl_tip-rule-lnk_sm-team_deedfd5baedfb968url
- https://www.kaspersky.com/enterprise-security/threat-analysis?icid=gl_sl_threat-analysis-lnk_sm-team_25b5f71358065007url
- https://www.kaspersky.com/enterprise-security/threat-intelligence-reporting?icid=gl_sl_post-link-tip-reports_sm-team_54d4bf9ad05581e5url
- https://opentip.kaspersky.com/5d5c3e483c5e544260ce98fc29fbf192/results?icid=gl_sl_tr-post-opentip_sm-team_3507d0288f81f8bc&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/7141917cba2eee2b4d31107faccf3a39/results?icid=gl_sl_tr-post-opentip_sm-team_80d026c1849d5c2c&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/f5c6434ee5f7578faa3bc1257e1c9226/results?icid=gl_sl_tr-post-opentip_sm-team_5815d54cadb20aaa&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/c019797a00fd56edb1f468ac0a598510/results?icid=gl_sl_tr-post-opentip_sm-team_b2469d4608f26c8c&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/a0ec7a8e61eff3f445a7455b3aef9fbb/results?icid=gl_sl_tr-post-opentip_sm-team_07b4e5b56e760696&utm_source=SL&utm_medium=SL&utm_campaign=SLurl