Armored Likho, also tracked as Eagle Werewolf, emerged in May 2023, with its activities publicly detailed by Kaspersky in July 2026. This China-aligned threat group operates with a dual motivation, blending financially driven attacks, such as credential and infostealer operations, with targeted cyber espionage against government agencies and the electric power sector. The group is distinguished by its use of AI-generated loaders, a custom modular infostealer named BusySnake Stealer, and its integration of reverse tunneling capabilities. Notably, it exploits vulnerabilities like CVE-2025-9491 and has demonstrated a pattern of targeting drone and UAV-related organizations, sometimes leveraging compromised Telegram channels for malware distribution.

This profile is generated from the same canonical actor-card record used by the Threat Actor Cards directory, so aliases, targeting fields, activity notes, and source links stay aligned as the database is enriched.