Armored Likho Deploys BusySnake Stealer Against Critical Infrastructure

On July 6, 2026, threat group Armored Likho used spear-phishing emails to deliver a new Python-based infostealer called BusySnake into government agencies and electrical power entities in Russia, Brazil, and Kazakhstan. The malware stole browser credentials, cookies, clipboard data, cryptographic keys, messaging information, and full Telegram sessions from compromised systems.

Confirmed Details of Attack

Public reporting indicates the attackers sent carefully crafted spear-phishing messages that tricked recipients into running the BusySnake stealer. Once inside the network, the tool quietly collected sensitive data including saved passwords, authentication cookies, encryption keys, chat histories, and active Telegram login tokens. No exact number of victims or total records exposed has been released. The campaign specifically targeted critical infrastructure operators rather than pursuing mass consumer infections.

Credentials, cookies, cryptographic keys, and Telegram sessions were among the primary data types harvested. The operation remained focused on government and power-sector targets across the three countries.

Why This Matters for You and Your Family

Even though the immediate targets were government and utility networks, the stolen credential material often ends up on underground markets where ordinary people’s accounts become collateral damage. A single leaked password or session token from one service can unlock email, banking, or social-media accounts that hold far more personal information about you and your family. When children’s usernames or school email addresses are linked to the same passwords, the risk spreads quickly to gaming platforms, homework portals, and family photo accounts.

Credential leaks like this one frequently cascade into account takeovers that lead to financial fraud, identity theft, or harassment. If your email password or a reused credential appears in the same datasets later sold by the attackers, your household can be swept into the next wave of abuse without warning.

The Doxxing and Identity-Chain Risk

BusySnake does more than grab isolated passwords. It pulls together browser data, messaging histories, cryptographic material, and Telegram sessions that attackers can combine with publicly available records to build detailed identity chains. A phone number tied to a Telegram session, a password reused on a family gaming account, and an email address harvested from a utility breach can quickly link back to your home address and the names of your children.

Once these connections are mapped, opportunistic criminals move from simple credential sales to full doxxing packages that include family member names, approximate locations, and live account access. Gaming accounts are especially vulnerable because children often reuse simple passwords or email addresses that appear in adult breaches, creating a direct bridge between corporate leaks and family life.

Armored Likho’s Known Track Record

Public reporting attributes the group’s emergence to operations beginning in 2024. Armored Likho has repeatedly focused on Russian-speaking targets and critical infrastructure entities, using spear-phishing as the initial access method. After gaining entry, the group exfiltrates credentials and session data, then either sells the material on underground forums or uses it for further intrusions and extortion. Their playbook emphasizes stealthy data theft over loud ransomware demands, allowing them to remain active while victims discover the compromise weeks or months later.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, gaming handles, and real-world identity so hidden connections become visible.
• Rotate every password used on government, utility, or messaging services that may have been exposed and switch to unique, strong passphrases everywhere they were reused.
• Enable continuous DoxxScan monitoring across 15.4B+ breach records and 100+ platforms so the next credential leak that touches your family is caught in hours rather than months.
• Cover the household with DoxxScan family protection that includes children’s gaming accounts and school logins which often chain back to the same addresses and credentials.
• Let remediation specialists handle takedown requests and broker removals while you focus on securing accounts and enabling authenticator-based 2FA on every important service.

The incident shows that sophisticated credential theft now reaches far beyond its original targets and can surface in unexpected places months later. Starting with a clear map of your family’s digital footprint gives you the best chance of staying ahead of these expanding chains. DoxxScan by GalaxyWarden delivers continuous monitoring across 15.4 billion breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.