Armored Likho expands its cyber-espionage toolkit

In May 2026, we discovered a new cyber-espionage campaign by the Armored Likho group, also known as Eagle Werewolf, that targets private individuals and organizations across various industries in Russia, including major corporations, the public sector, IT, and education. The attackers used a fake app as bait that mimics a service for donations. However, the most interesting part of this campaign isn’t the initial infection method - it’s the malicious implants the attackers use for cyber-espionage. We’ve written previously about recent Armored Likho attacks, but our analysis shows that the campaign discussed below has more in common with the group’s activity from February. That said, the attackers have significantly expanded their arsenal. During our research, we found a new cyber-espionage toolkit written in Rust: the Still Toolkit. One of its components, Still Sync, steals Telegram session data to gain ongoing access to the victim’s account. With this stolen data, attackers can leverage the Telegram API to automatically pull chat logs, media files, and other information from the account. The second component, Still Audio, is an implant for covert audio surveillance. It analyzes the incoming audio stream, automatically detects speech, records conversations, and sends the recordings to a command-and-control server. In this article, we’ll look at the initial infection method, how the new Still Toolkit components are built, and the technical details of how they operate. Kaspersky products detect this threat as Trojan.Win64.Agent.* and HEUR:Backdoor.Win32.Generic . Background Armored Likho’s malicious activity has been documented several times before: in November 2024, and in February and July 2026. The current campaign shows significant overlap with the November and February campaigns, which used malicious droppers disguised as documents and applications related to Starlink activation or fundraising efforts as the initial infection vector. This campaign also uses fundraising as its lure. At the same time, our research uncovered a number of new tools that point to the attackers expanding their capabilities. Initial infection The infection chain starts with an app that mimics a donation service. As of this writing, the app distribution method remains unknown. During our research, however, we obtained several samples posing as apps from different Russian foundations. In reality, the app is a dropper. Its developers wrote it in Rust on top of the popular Tauri framework, and it has a graphical interface designed to deceive the user. After launch, it displays a login form that asks for a password, presumably one the attackers supplied. After the user enters a valid password, they see a catalog of donatable items. The app pulls item and category information from orderapiserver[.]info through the public/categories and public/products endpoints . A clickable catalog makes the app look legitimate. While the user browses the items, the dropper quietly decrypts and launches the payload for the next stage in the background. Our analysis shows that the mechanism for decrypting the payload and launching subsequent stages hasn’t changed since the February campaign. However, we found a new cyber-espionage toolkit - the Still Toolkit - made up of two components: Still Sync and Still Audio. Still Sync Still Sync is a stealer written in Rust that steals Telegram session data. However, its capabilities don’t stop there. With this stolen data, Sync can log in to the victim’s account and pull messages and media files through the Telegram API. Architecturally, Sync is an asynchronous application based on the Tokio library. It talks to the server over gRPC and serializes messages with FlatBuffers. It supports both HTTP and HTTPS as transport protocols; the URL of the command-and-control server determines which one it uses. How it works When Sync launches, the attackers set several environment variables. Before starting any malicious activity, the implant pulls configuration parameters from these: - STILL_SYNC_ADDR: the address of the command-and-control server. By default, this is https://tg4service[.]com:443 . - STILL_SEND_PATH: the path to the tdata - STILL_TELEGRAM_PASSCODE: the password for decrypting the tdata folder, if Telegram data encryption is enabled on the victim’s device. Sync also supports several command-line arguments: --console : runs as a console application. If this parameter is absent, the implant creates a TReload service to keep running in the background.--version : prints version information and exits.--firefly : launches a trace thread that monitors the program’s operation. It writes error messages to a hidden file, bin, located in the same folder as the main executable.--db : turns on debug mode with detailed logging. Once it launches, the malware begins registering the device with the C2 server. To do this, Sync collects the following information about the victim’s system: - Motherboard serial number - CPU ID - System UUID - BIOS serial number - Computer domain name The malware combines the collected data into a single string with a colon as the separator. It then hashes that string with SHA-256 and stores the resulting hash under the key sysmarker . Worth noting: other Armored Likho tools, AquilaRAT included, use this same hashing algorithm. Sync then serializes a package containing all the collected information and the agent version, and sends it in a POST request to /still.rpc.Sync/RegisterMachine . The response contains a machine_id value, which Sync uses to identify itself in subsequent requests. Once registration succeeds, Sync sends a POST request with the machine_id parameter to /still.rpc.Sync/GetMachineSettings . The server responds with the following settings: - enabled: triggers malicious activity on the infected device. - scan_portable: turns on extended scanning when searching for the tdata We’ll cover this feature in more detail below. - fetch_telegram: if this parameter is on, Sync attempts to log in to Telegram and extract data. We’ll cover this feature in more detail below. - download_channels: if this parameter is off, Sync skips channel dialogs when exfiltrating Telegram data. These parameters have no default values, so Sync doesn’t perform any malicious actions until the registration and settings-retrieval processes both complete successfully. Telegram data collection Before stealing a Telegram session, Sync searches for the tdata folder, unless the STILL_SEND_PATH variable is already set. The list of search paths includes both standard and nonstandard directories, if the scan_portable option is turned on: - C:\Users\ \AppData\Roaming\Telegram Desktop: the standard Telegram Desktop installation directory. - C:\Users\ \AppData\Local\Packages\ \LocalCache\Roaming: the installation directory for the Microsoft Store version. Sync identifies the package folder by a name that contains the string TelegramMessenge. - C:: used for the extended search (if the scan_portable option is on). Sync then sends a POST request with a list of files from the tdata folder to the /still.rpc.Sync/CheckFiles endpoint. The server responds with the following values: - snapshot_id: an identifier the server assigns to the current data snapshot. - present: a list of file paths that are already present on the server. This lets the C2 server avoid re-receiving files it already has. In addition, if Sync can’t access files on disk through standard methods, it falls back on three mechanisms that abuse the SeBackupPrivilege privilege: - Opening files with the CreateFileW function using theFILE_FLAG_BACKUP_SEMANTICS parameter - Creating a backup copy through the Shadow Copy service and reading files from there - If the previous methods all fail, attempting to copy the file using the Robocopy utility in backup mode Beyond stealing Telegram session data, Sync can carry out full-scale collection of user information from the messaging app. When the fetch_telegram option is on, it launches a separate thread that authenticates to the chat app using the previously obtained tdata . Once authentication succeeds, Sync gains access to the account data and sends the following collected information to the server: - User details, such as username, phone number, first and last name - Information about private chats, groups, or channels, such as chat name and ID, the member list, and so on - Dialogs from private chats, groups, and channels (if the download_channels option is on) - Media files under 250MB: photos, documents, stickers, and contacts Still Audio Still Audio is an audio surveillance implant written in Rust. Its main job is to analyze the incoming audio stream and start recording voice when certain conditions are met - we’ll cover those in the next section. Architecturally, Still Audio largely mirrors Sync and uses the same mechanisms for communicating with the C2 server. On launch, Still Audio performs a sequence of actions: - It extracts libmp3lame.dll , a file stored inside the executable. This is a library used to encode audio data. - If the --console command-line argument is absent, the implant creates a service namedauxhost , connects to it, and continues running in the background. - While running in the background, it creates a file, logfile.log , to write logs to. Next, Still Audio retrieves the C2 server address. As with Sync, it stores the URL in an environment variable - in this case, STILL_AUDIO_SYNC_ADDR. If that variable isn’t set, it falls back to STILL_SYNC_ADDR, which shows the two modules are compatible with each other. If neither variable is set, it uses the default URL, https://srwinservice[.]com . Still Audio also uses the Dead Drop Resolver technique as a fallback mechanism for obtaining the C2 address. If the current server stays unreachable for three days, the tool tries to pull the current C2 URL from a GitHub repository. In the sample under analysis, we found the following URL for the page containing C