Armored Likho is a previously undocumented threat actor targeting government agencies and electric power sectors in Russia, Brazil, and Kazakhstan. They blend financially motivated campaigns with cyber espionage, using obfuscated RATs and infostealers like BusySnake Stealer. They share overlaps with Eagle Werewolf and use tools like Go2Tunnel for network tunneling.