Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer

The Hacker News

July 3, 2026 at 1:36 PM

Actively Exploited

Overview

A new cyber threat group called Armored Likho has been linked to attacks against government agencies and the electric power sector in Russia, Brazil, and Kazakhstan. Researchers from Kaspersky report that this group combines financially motivated schemes targeting individuals with cyber espionage aimed at organizations. The BusySnake Stealer malware is being used in these operations, which raises concerns about the potential for sensitive data breaches. The targeting of critical infrastructure like power sectors is particularly alarming, as it can have severe implications for national security and public safety. Organizations in affected regions should bolster their cybersecurity measures to defend against these types of attacks.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Government agencies, electric power sector systems in Russia, Brazil, and Kazakhstan
Action Required: Organizations should enhance their cybersecurity protocols, conduct regular security audits, and implement robust monitoring systems to detect and respond to potential threats.
Timeline: Newly disclosed

Original Article Summary

A previously undocumented threat actor known as Armored Likho has been attributed to cyber attacks targeting government agencies and the electric power sector across Russia, Brazil, and Kazakhstan. "Armored Likho blends financially motivated campaigns targeting private individuals with targeted cyber espionage aimed at organizations," Kaspersky said in a technical analysis published today. "

Impact

Government agencies, electric power sector systems in Russia, Brazil, and Kazakhstan

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Organizations should enhance their cybersecurity protocols, conduct regular security audits, and implement robust monitoring systems to detect and respond to potential threats.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Malware, Critical, Kaspersky.

Read Original Article

Related Coverage

Flock Cameras Can Surveil Cars Without License Plates

Schneier on Security

Flock Safety, a surveillance camera company, has introduced a new feature that allows law enforcement to identify vehicles even when they lack visible license plates. This system, referred to as a ‘Vehicle Fingerprint’, collects data on a vehicle’s decals, bumper stickers, and other unique identifiers, enabling officers to gather more information without complete plate details. Additionally, the technology supports a 'multi geo search', helping police track multiple vehicles believed to be traveling together. This development raises concerns about privacy and the extent of surveillance capabilities available to law enforcement, as it could lead to increased monitoring of individuals who are not necessarily under investigation. As law enforcement agencies adopt these technologies, the implications for civil liberties and personal privacy will be significant.

Jul 3, 2026

Agentic AI Used to Conduct Ransomware Attack via Langflow

SecurityWeek

Recent research has shown that attackers are using advanced AI tools, specifically Agentic AI via Langflow, to conduct sophisticated ransomware attacks. This method allows them to automate complex intrusions by combining known exploitation techniques with real-time reasoning. The implications of this development are significant; it suggests that cybercriminals can now execute multi-stage attacks with greater efficiency and less human oversight. Organizations need to be aware of these evolving tactics and bolster their defenses against such automated threats to protect sensitive data and infrastructure. As AI technology becomes more accessible, the risk of automated attacks may increase, making it crucial for companies to stay vigilant.

Jul 3, 2026

Medtronic Data Breach Impacts 3.8 Million People

SecurityWeek

In April, the hacker group ShinyHunters breached Medtronic's corporate IT systems, compromising the personal and medical information of approximately 3.8 million individuals. This incident raises serious concerns about patient privacy and data security, as sensitive information could potentially be used for identity theft or fraud. Medtronic has not disclosed the specific types of data accessed, but given the nature of the breach, it likely includes critical health-related details. The event serves as a stark reminder of the vulnerabilities that exist within healthcare systems and the ongoing threat posed by cybercriminals. Organizations in the healthcare sector need to bolster their defenses to protect sensitive patient data from similar attacks in the future.

Jul 3, 2026

PamStealer Uses Fake Maccy Sites and PAM Checks to Steal Mac Login Passwords

The Hacker News

Researchers from Jamf Threat Labs have identified a new malware targeting macOS users, named PamStealer. This information stealer masquerades as a legitimate application called Maccy, which is a popular open-source clipboard manager. By distributing a compiled AppleScript file that looks legitimate, PamStealer tricks users into downloading it. Once installed, it seeks to extract sensitive information, including Mac login passwords. This incident is concerning for Mac users, as it highlights the ongoing risks posed by malware that exploits trusted applications to gain access to personal data.

Jul 3, 2026

Government and Healthcare Are the Weakest Links in Global Email Security

Security Affairs

A recent analysis by Comparitech has revealed that the government and healthcare sectors are particularly vulnerable to email security threats. The study examined 5,849 domains across 13 different sectors and found that many of them do not implement essential email authentication protocols such as SPF, DMARC, DKIM, and MTA-STS. Without these protections, these domains are at a higher risk of phishing attacks, which can lead to data breaches and compromised sensitive information. This situation is concerning given the critical nature of the data handled by these sectors, and it highlights a significant gap in cybersecurity practices that needs urgent attention. Improving email security measures could help protect against potential attacks and safeguard sensitive information.

Jul 3, 2026

Someone infected a spyware probe overseer with spyware

CyberScoop

Citizen Lab has reported that a member of Europe’s PEGA Committee, which oversees spyware usage, had their phone infected with Pegasus spyware on two occasions. Pegasus is notorious for its ability to infiltrate devices and extract sensitive information, raising serious concerns about privacy and security for individuals in positions of oversight. This incident is particularly alarming because it highlights the potential for those tasked with monitoring spyware to themselves become targets. The implications extend beyond personal privacy, as it raises questions about the integrity of oversight bodies and the effectiveness of regulations governing spyware use. The ongoing use of such invasive tools poses a threat to democratic processes and civil liberties.

Jul 3, 2026