BusySnake RAT

Armored Likho Expands Arsenal with BusySnake RAT and AI-Driven Malware Development

The cybercrime group Armored Likho has introduced a new multi-platform trojan called BusySnake RAT that targets Windows, Linux, and macOS systems. Researchers at Kaspersky Lab identified three distinct versions of the malware, evolving from a Python implementation using Telegram bots for command-and-control to a GitLab-based variant and finally a fully rewritten Go version. In addition to custom development, the group has incorporated the open-source Kharon RAT to facilitate remote access and data exfiltration. Armored Likho has also shifted its infrastructure to private GitHub and GitLab repositories to hinder analysis. Most notably, the group now leverages large language models not only for initial access but also to generate tools for persistence and post-exploitation activities. Kaspersky security products continue to detect and block activity linked to the group.