Two separate threat actor groups reported in the last week demonstrate that old techniques still deliver when attackers adapt them to modern environments. On July 7, Proofpoint detailed a China-aligned group exploiting Roundcube webmail vulnerabilities against U.S. and Canadian universities. A day earlier, Kaspersky named a new APT called Armored Likho that uses AI-generated loaders and a Python stealer to hit government and energy organizations in Russia, Kazakhstan, and Brazil. Both campaigns target sensitive data. Both rely on phishing as the initial vector. But the technical details differ in ways that matter for defenders.
Armored Likho and BusySnake: AI-powered loaders, Python stealers, and SSH tunnels
Kaspersky tracked an ongoing spear-phishing operation that targets government agencies and electric power organizations. They named the group Armored Likho, also known as Eagle Werewolf. The malware toolkit centers on a Python-based infostealer called BusySnake.
The attack chain starts with spear-phishing emails using lure themes like official government notices, humanitarian aid applications, and psychological tests. The emails contain malicious archive attachments that follow two delivery patterns. The first uses Nullsoft Scriptable Install System (NSIS) EXE droppers. The second uses malicious LNK shortcuts that abuse how Windows handles .lnk parameters.
In the EXE route, the NSIS dropper launches a legitimate process and injects malicious loader code into it. In the LNK route, an obfuscated PowerShell command downloads and runs the loader. From there, the loader pulls Python components and the BusySnake payload from GitHub-hosted archives before setting up persistence.
Once installed, BusySnake does a lot. It logs clipboard contents, harvests browser cookies, pulls session tokens from Telegram, exfiltrates documents, captures screenshots, scrapes two-factor authentication secrets, and searches for cryptocurrency wallets. The attackers also built reverse SSH tunneling into BusySnake. That gives them remote access to manually inspect compromised systems and pull out targeted files after infection.
What makes this group harder to track is their use of AI to generate initial malicious payloads. Kaspersky noted that the code structure changes enough to obscure the group's normal habits and complicate attribution. This automated approach means signature-based detection will struggle. The group also shows no sign of slowing down. Kaspersky said they remain highly active and continue to evolve their malware variants.
Kaspersky linked Armored Likho to earlier activity involving AquilaRAT. Both use similar C2 endpoints and scheduled tasks that pose as legitimate Microsoft utilities. AquilaRAT uses MicrosoftOfficeUpdate; BusySnake uses WindowsHelper. The group appears to have two motives: financially motivated targeting of private individuals and cyber-espionage aimed at organizations. I find it notable that they maintain both tracks. Most APTs pick one lane.
IceCube JavaScript stealer: Roundcube XSS as a gateway into university research networks
Meanwhile, Proofpoint uncovered a campaign by a group they track as UNK_MassTraction, a suspected China-aligned espionage group. Since May 2026, the group has targeted physics and engineering departments at universities in the U.S. and Canada, especially individuals involved in research sensitive to national security, astrophysics, and particle physics.
The attack abuses Roundcube webmail vulnerabilities. It starts with CVE-2024-42009, a cross-site scripting (XSS) flaw in Roundcube's HTML sanitization. When a victim opens a crafted email, an onanimationstart event triggers embedded JavaScript. That JavaScript loads an external file called IceCube. Proofpoint found comments in the code suggesting a large language model helped create it.
IceCube bypasses Roundcube's iframe restrictions via DOM traversal, giving it full access to the browser context and any authenticated sessions. It collects usernames, passwords, session cookies, and two-factor authentication data. It also profiles the victim's environment: browser language, screen resolution, form inputs. Stolen data goes to C2 servers via HTTP POST.
The attack does not stop at credential theft. IceCube exploits another vulnerability, CVE-2025-49113, a PHP deserialization flaw in Roundcube's Crypt_GPG_Engine. Successful exploitation installs a lightweight webshell called SquareShell. The webshell is placed in a plugin-like path with timestamps altered to match legitimate files. It can execute system-level commands through PHP functions like system, exec, and shell_exec.
If webshell deployment fails, the infection chain pivots to a fallback mechanism introduced in June 2026. This involves a shell script that downloads an architecture-specific ELF loader, typically associated with SNOWLIGHT tooling. The loader establishes persistence, masquerades as a benign process like [kworker/0:2], and loads the VShell backdoor directly into memory. VShell is a cross-platform Go-based implant that provides interactive shell access and port forwarding, enabling lateral movement.
Proofpoint attributed the campaign to China-aligned actors based on Chinese-language artifacts in phishing emails, use of VPS-based C2 servers, and deployment of VShell. The group treats compromised mail servers as entry points into larger institutional networks. Unlike financially motivated campaigns, UNK_MassTraction aligns with espionage objectives: steal research, stay persistent.
One detail I find interesting is the built-in cleanup and persistence steps. After running, IceCube clears traces from local storage, closes active sessions, and checks for a marker file in the temp directory to avoid reinfecting the same machine. That is careful operational security. Also, the operators used compromised accounts and domains to send the phishing emails. That makes the phishing harder to dismiss. The emails came from real people in the same institution.
Practical takeaways for defenders
Both campaigns share a common thread: they exploit human behavior first, then software flaws. Technical controls matter, but the initial compromise happens when someone opens an attachment or clicks a link.
For Roundcube users, patch CVE-2024-42009 and CVE-2025-49113 immediately. Proofpoint also recommends enforcing strict email authentication policies and monitoring for unusual webmail activity. Check mail server logs and web directory changes for new or modified files. The SquareShell webshell hides as a plugin file, so file integrity monitoring helps.
For organizations vulnerable to spear-phishing, the Armored Likho campaign shows that AI-generated payloads will defeat hash-based detection. Focus on behavioral detection: monitor for unusual process injections, PowerShell execution from unexpected sources, and outbound SSH tunnels. Block GitHub archive downloads unless explicitly needed. Kaspersky shared that the group uses reverse SSH tunneling, so network monitoring for SSH connections to unknown IPs is worth adding.
Both campaigns also target specific sectors: government, energy, and universities. If you work in those sectors, treat compromised email systems as a critical attack surface. The UNK_MassTraction campaign shows that the goal is not just email access but lateral movement into research networks. Segment your mail servers. Restrict outbound internet access from those servers. Use multi-factor authentication that resists cookie theft, such as hardware tokens.
I also recommend reading the full Kaspersky and Proofpoint reports. They include IOCs: IP addresses, file hashes, and URLs. Both are linked from the Hackread summary. Defenders should feed those into their threat intelligence platforms.
The campaigns are not related to each other, but together they illustrate a trend. Attackers are getting better at using commodity tools commercial webmail platforms. They write custom Python stealers and JavaScript backdoors. They use AI to blur attribution. And they persist. BusinessSnake and IceCube are still active. The question is whether your organization is ready for the next spear-phishing email.