Armored Likho Evolves with Rust-Based 'Still Toolkit' for Cyber-Espionage
The Armored Likho threat group has updated its cyber-espionage toolkit with new Rust-based implants, including one that steals Telegram session data and another for covert audio surveillance, targeting Russian organizations.
The Armored Likho (Eagle Werewolf) group, a persistent cyber-espionage actor, has significantly expanded its offensive capabilities with a new toolkit written in the Rust programming language. This evolution was observed in a recent campaign targeting individuals and organizations across Russia, encompassing sectors such as major corporations, public administration, IT, and education. The group's modus operandi involves luring victims with a fake donation application, a tactic that has shown overlap with their previous activities from February 2026, but now augmented with more sophisticated implants.
One of the key components of this new arsenal is the 'Still Sync' implant. Written in Rust, Still Sync is designed to steal Telegram session data, thereby granting attackers persistent access to a victim's account. Once session data is compromised, the malware can leverage the official Telegram API to automatically exfiltrate chat logs, media files, and other sensitive information directly from the user's account. This capability allows for deep and ongoing surveillance of communications and data.
The second notable component is 'Still Audio,' an implant focused on covert audio surveillance. This tool is capable of analyzing incoming audio streams in real-time. It automatically detects speech, records conversations, and then transmits these audio recordings to a command-and-control (C2) server operated by the attackers. This implant enables the group to conduct eavesdropping operations without the victim's knowledge, capturing sensitive discussions.
The initial infection vector for this campaign involves a dropper application disguised as a legitimate service for donations. While the exact distribution method remains unclear, samples have been found impersonating apps from various Russian foundations. The dropper, also developed in Rust using the Tauri framework, features a deceptive graphical interface. After a user enters a password provided by the attackers, the app displays a catalog of donation items, pulling data from a remote server to appear authentic.
While the user is engaged with the fake donation catalog, the dropper operates in the background, decrypting and launching the next stage of the payload. The mechanism for this payload delivery and execution appears consistent with the group's February campaign. However, the introduction of the Still Toolkit marks a significant upgrade in their espionage capabilities, moving beyond previously observed tools.
Technically, Still Sync operates asynchronously using the Tokio library and communicates with its C2 server over gRPC, serializing messages with FlatBuffers. It supports both HTTP and HTTPS protocols, with the choice determined by the C2 server's address, typically tg4service[.]com. The implant is configured via environment variables, including the C2 server address and paths for data exfiltration. It also supports command-line arguments for controlling its execution, such as running as a console application or a background service.
Upon execution, Still Sync registers the infected device with the C2 server by collecting system information like motherboard serial number, CPU ID, and system UUID. This data is hashed using SHA-256, a method consistent with other Armored Likho tools like AquilaRAT. After successful registration, the malware fetches configuration settings from the C2 server, which dictate whether malicious activities, such as extended scanning for portable Telegram data, are enabled.
Kaspersky products detect these threats under generic names like Trojan.Win64.Agent.* and HEUR:Backdoor.Win32.Generic. The continued evolution of Armored Likho's toolkit, particularly its adoption of Rust for new implants like Still Sync and Still Audio, underscores the group's commitment to sophisticated cyber-espionage and their ability to adapt to new development environments to enhance their operational effectiveness.
This new report details the specific technical capabilities of the Armored Likho group's 'Still Toolkit,' highlighting its Rust-based construction and its dual functionality: stealing Telegram session data for account takeover and recording victim conversations via microphone. The toolkit's distribution through a fake donation app is also elaborated upon, providing a clearer picture of the social engineering tactics employed.