AI‑Generated Malware Fuels “Armored Likho” APT Campaign Targeting Governments and Power Grids
What Happened — Kaspersky researchers identified a new APT group, “Armored Likho,” that uses AI‑generated, heavily obfuscated malware (modular RATs, the BusySnake Python infostealer, and Go2Tunnel) delivered via spear‑phishing emails and a ZDI‑CAN‑25373 LNK shortcut vulnerability. The campaign is aimed at government agencies and electric‑utility operators in Russia, Kazakhstan, and Brazil, with a parallel financially‑motivated track against private individuals.
Why It Matters for Compliance & Audit Readiness
- Spear‑phishing and LNK‑based execution bypass traditional perimeter controls, highlighting the need for documented Security Awareness Training and phishing‑simulation programs that satisfy SOC 2 CC6.1 (Security) and CC6.2 (Risk Management).
- The AI‑generated payloads are deliberately crafted to evade dynamic analysis, underscoring the importance of continuous monitoring of endpoint detection controls and evidence collection for audit‑ready incident‑response processes.
Who Is Affected — Government & public‑sector entities, electric‑utility operators, and any organization with high‑value intellectual property or critical‑infrastructure exposure.
Recommended Actions
- Map the phishing vector to SOC 2 CC6.1 controls; update your security‑awareness curriculum to include AI‑generated malware indicators and LNK shortcut abuse.
- Deploy endpoint telemetry that captures execution of NSIS self‑extractors and PowerShell‑based loaders; retain logs as audit evidence of control effectiveness.
Source: Security Affairs – AI‑Generated Malware Powers New Armored Likho APT Campaign
Technical Notes
- Attack vector: spear‑phishing emails with malicious NSIS archives or LNK shortcuts exploiting ZDI‑CAN‑25373.
- Malware stack: obfuscated Go and Python RATs, BusySnake Stealer (Python 3.12), Go2Tunnel tunneling tool.
- No public CVE for the custom loader; the LNK exploit is tracked as ZDI‑CAN‑25373.