Armored Likho

Active

1 briefing · first covered 7/5/2026 · last covered 7/5/2026

Indicators of Compromise

Artifact	Type
winupdate[.]live	C2 domain
arvax[.]xyz	C2 domain
varenie[.]live	C2 domain
lvl99[.]store	C2 domain
grked[.]online	C2 domain
myboard[.]chickenkiller.com	C2 domain
159.198.41[.]140	C2 IP address
159.198.32[.]222	C2 IP address
69.67.173[.]153	C2 IP address
C7622A1EFFA27BBFEE6D6E03D6474343	BusySnake Stealer PYW (original)
80B7700053E115D65365CE7330383320	BusySnake Stealer (updated version)
1096268FA2B3D454C86CF851CB782319	EXE dropper

Subscribe to unlock this actor's full IOC list

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Attribution & Known Techniques

Not tracked in MITRE ATT&CK or MISP's open threat-actor/ransomware galaxies as of the last check — real absence, not a gap in our lookup. Both sources skew toward nation-state APTs and well-established ransomware brands; this one may simply not have a public group profile yet.

Coverage Timeline

7/5/2026 · KNOW YOUR ENEMY

Armored Likho: AI-Generated Malware Hits Power Grids in 3 Countries

Armored Likho BusySnake stealer is hitting power grids in 3 countries with AI-generated malware. Here is what you need to detect it.

Not yet tracked for this actor

CrowdStrike Falcon / SentinelOne Deep Visibility-specific query syntax — hunting queries above (if any) are Microsoft Defender/Sentinel KQL
File transfer and exfiltration services used
MITRE ATT&CK techniques and structured country/sector attribution — see the note above