A cyber intrusion attributed to the threat actor Armored Likho is ongoing, targeting government agencies and the electric power sector in Russia. The attack leveraged spear-phishing emails with malicious attachments—specifically ZIP files containing executable payloads or LNK files—to deploy a Python-based infostealer named BusySnake Stealer. The malware established persistent access through scheduled tasks and COM object-based task scheduling, evaded detection via code obfuscation, runtime encryption using PyArmor, and self-deletion mechanisms. It is harvesting sensitive data, including browser credentials, cookies, and clipboard contents, and exfiltrating information via encrypted channels to a command-and-control server. Remote access capabilities were enabled through reverse SSH tunneling. The campaign exhibits characteristics of both espionage and financial gain motives.