[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPhtDm-IwvFChGP2ypVPOyz4W-IwTG5e4ESHzSXVAjuw":3},{"article":4,"iocs":47},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":31,"category":32,"article_tags":36},"28aac862-4a16-4179-a9cc-589049808679","Armored Likho expands its cyber-espionage toolkit","armored-likho-expands-its-cyber-espionage-toolkit-42d8bf","Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.","The Armored Likho group, also known as Eagle Werewolf, has launched a new cyber-espionage campaign targeting individuals and organizations in Russia. This campaign utilizes a fake fundraising app as an initial infection vector and deploys a newly developed toolkit called \"Still Toolkit.\" The toolkit includes components designed to steal Telegram session data for account access and conduct covert audio surveillance.","Armored Likho expands cyber-espionage with new Rust-based Still Toolkit targeting Telegram data and audio.","Table of Contents BackgroundInitial infectionStill SyncHow it worksTelegram data collectionStill AudioThe eavesdropping processInfrastructureVictimsAttributionTakeawaysIndicators of compromise Authors Konstantin Isakov In May 2026, we discovered a new cyber-espionage campaign by the Armored Likho group, also known as Eagle Werewolf, that targets private individuals and organizations across various industries in Russia, including major corporations, the public sector, IT, and education. The attackers used a fake app as bait that mimics a service for donations. However, the most interesting part of this campaign isn’t the initial infection method – it’s the malicious implants the attackers use for cyber-espionage. We’ve written previously about recent Armored Likho attacks, but our analysis shows that the campaign discussed below has more in common with the group’s activity from February. That said, the attackers have significantly expanded their arsenal. During our research, we found a new cyber-espionage toolkit written in Rust: the Still Toolkit. One of its components, Still Sync, steals Telegram session data to gain ongoing access to the victim’s account. With this stolen data, attackers can leverage the Telegram API to automatically pull chat logs, media files, and other information from the account. The second component, Still Audio, is an implant for covert audio surveillance. It analyzes the incoming audio stream, automatically detects speech, records conversations, and sends the recordings to a command-and-control server. In this article, we’ll look at the initial infection method, how the new Still Toolkit components are built, and the technical details of how they operate. Kaspersky products detect this threat as Trojan.Win64.Agent.* and HEUR:Backdoor.Win32.Generic. Background Armored Likho’s malicious activity has been documented several times before: in November 2024, and in February and July 2026. The current campaign shows significant overlap with the November and February campaigns, which used malicious droppers disguised as documents and applications related to Starlink activation or fundraising efforts as the initial infection vector. This campaign also uses fundraising as its lure. At the same time, our research uncovered a number of new tools that point to the attackers expanding their capabilities. Initial infection The infection chain starts with an app that mimics a donation service. As of this writing, the app distribution method remains unknown. During our research, however, we obtained several samples posing as apps from different Russian foundations. In reality, the app is a dropper. Its developers wrote it in Rust on top of the popular Tauri framework, and it has a graphical interface designed to deceive the user. After launch, it displays a login form that asks for a password, presumably one the attackers supplied. The login form After the user enters a valid password, they see a catalog of donatable items. The app pulls item and category information from orderapiserver[.]info through the public\u002Fcategories and public\u002Fproducts endpoints. A clickable catalog makes the app look legitimate. While the user browses the items, the dropper quietly decrypts and launches the payload for the next stage in the background. Our analysis shows that the mechanism for decrypting the payload and launching subsequent stages hasn’t changed since the February campaign. However, we found a new cyber-espionage toolkit – the Still Toolkit – made up of two components: Still Sync and Still Audio. Still Sync Still Sync is a stealer written in Rust that steals Telegram session data. However, its capabilities don’t stop there. With this stolen data, Sync can log in to the victim’s account and pull messages and media files through the Telegram API. Architecturally, Sync is an asynchronous application based on the Tokio library. It talks to the server over gRPC and serializes messages with FlatBuffers. It supports both HTTP and HTTPS as transport protocols; the URL of the command-and-control server determines which one it uses. How it works When Sync launches, the attackers set several environment variables. Before starting any malicious activity, the implant pulls configuration parameters from these: STILL_SYNC_ADDR: the address of the command-and-control server. By default, this is https:\u002F\u002Ftg4service[.]com:443. STILL_SEND_PATH: the path to the tdata STILL_TELEGRAM_PASSCODE: the password for decrypting the tdata folder, if Telegram data encryption is enabled on the victim’s device. Sync also supports several command-line arguments: --console: runs as a console application. If this parameter is absent, the implant creates a TReload service to keep running in the background. --version: prints version information and exits. --firefly: launches a trace thread that monitors the program’s operation. It writes error messages to a hidden file, bin, located in the same folder as the main executable. --db: turns on debug mode with detailed logging. Example Still Sync logs Once it launches, the malware begins registering the device with the C2 server. To do this, Sync collects the following information about the victim’s system: Motherboard serial number CPU ID System UUID BIOS serial number Computer domain name The malware combines the collected data into a single string with a colon as the separator. It then hashes that string with SHA-256 and stores the resulting hash under the key sysmarker. Worth noting: other Armored Likho tools, AquilaRAT included, use this same hashing algorithm. Sync then serializes a package containing all the collected information and the agent version, and sends it in a POST request to \u002Fstill.rpc.Sync\u002FRegisterMachine. The response contains a machine_id value, which Sync uses to identify itself in subsequent requests. Once registration succeeds, Sync sends a POST request with the machine_id parameter to \u002Fstill.rpc.Sync\u002FGetMachineSettings. The server responds with the following settings: enabled: triggers malicious activity on the infected device. scan_portable: turns on extended scanning when searching for the tdata We’ll cover this feature in more detail below. fetch_telegram: if this parameter is on, Sync attempts to log in to Telegram and extract data. We’ll cover this feature in more detail below. download_channels: if this parameter is off, Sync skips channel dialogs when exfiltrating Telegram data. These parameters have no default values, so Sync doesn’t perform any malicious actions until the registration and settings-retrieval processes both complete successfully. Telegram data collection Before stealing a Telegram session, Sync searches for the tdata folder, unless the STILL_SEND_PATH variable is already set. The list of search paths includes both standard and nonstandard directories, if the scan_portable option is turned on: C:\\Users\\\u003Cusername>\\AppData\\Roaming\\Telegram Desktop\\: the standard Telegram Desktop installation directory. C:\\Users\\\u003Cusername>\\AppData\\Local\\Packages\\\u003Cpackage_folder>\\LocalCache\\Roaming\\: the installation directory for the Microsoft Store version. Sync identifies the package folder by a name that contains the string TelegramMessenge. C:\\: used for the extended search (if the scan_portable option is on). Sync then sends a POST request with a list of files from the tdata folder to the \u002Fstill.rpc.Sync\u002FCheckFiles endpoint. The server responds with the following values: snapshot_id: an identifier the server assigns to the current data snapshot. present: a list of file paths that are already present on the server. This lets the C2 server avoid re-receiving files it already has. In addition, if Sync can’t access files on disk through standard methods, it falls back on three mechanisms that abuse the SeBackupPrivilege privilege: Opening files with the CreateFileW function using the FILE_FLAG_BACKUP_SEMANTICS parameter Creating a backup copy through the Shadow Copy service and reading files from there If the pr","https:\u002F\u002Fsecurelist.com\u002Farmored-likho-still-toolkit\u002F121033\u002F","https:\u002F\u002Fmedia.kasperskycontenthub.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F43\u002F2026\u002F08\u002F12200329\u002FSL-Armored-Likho-Still-Toolkit-featured-scaled-1.jpg","2026-08-13T08:00:15+00:00","2026-08-13T10:00:14.435269+00:00",8,[18,21,23,26,29],{"name":19,"type":20},"Armored Likho","threat_actor",{"name":22,"type":20},"Eagle Werewolf",{"name":24,"type":25},"Telegram","product",{"name":27,"type":28},"Rust","technology",{"name":30,"type":28},"Tauri","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[48,52,55,58,61,64],{"type":49,"value":50,"context":51},"domain","orderapiserver[.]info","Domain used by the dropper to pull item and category information for the fake donation app.",{"type":46,"value":53,"context":54},"Still Toolkit","New cyber-espionage toolkit developed by Armored Likho.",{"type":46,"value":56,"context":57},"Still Sync","Component of Still Toolkit that steals Telegram session data.",{"type":46,"value":59,"context":60},"Still Audio","Component of Still Toolkit for covert audio surveillance.",{"type":46,"value":62,"context":63},"Trojan.Win64.Agent.*","Kaspersky detection name for the threat.",{"type":46,"value":65,"context":66},"HEUR:Backdoor.Win32.Generic","Kaspersky heuristic detection name for the threat."]