A new threat actor, Armored Likho, has been identified targeting government agencies and the electric power sector in Russia, Brazil, and Kazakhstan. This group employs a blend of financially motivated campaigns and cyber espionage, utilizing spear-phishing, AI-generated loaders, and a new Python-based tool called BusySnake Stealer. The dual nature of their operations indicates a sophisticated and adaptive adversary.