Armored Likho Deploys 'Still Toolkit' to Hijack Telegram Sessions and Eavesdrop on Users

A sophisticated cyber-espionage group known as Armored Likho (also tracked as Eagle Werewolf) has significantly escalated its attacks on Telegram users, deploying a new Rust-based malware arsenal dubbed the Still Toolkit. According to a new report from Kaspersky, the campaign targets private individuals, government sectors, and IT corporations in Russia. The attackers are utilizing a fake donation application as bait to quietly install two highly specialized implants: Still Sync, designed to hijack Telegram sessions, and Still Audio, a covert eavesdropping tool.

The infection chain begins with a deceptive dropper built on the Tokio framework. Once a victim enters a password provided by the attackers, the app displays a functional catalog of donatable items pulled from the orderapiserver[.]info domain. While the user browses, the dropper silently decrypts and executes the Still Toolkit payload in the background, utilizing the same multi-part encryption format seen in the group's previous AquilaRAT campaigns.

The primary component, Still Sync, is an asynchronous Rust application that communicates with its command-and-control (C2) server over gRPC, serializing messages via FlatBuffers. Before initiating malicious activity, the implant pulls configuration parameters from specific environment variables:

STILL_SYNC_ADDR
STILL_SEND_PATH
STILL_TELEGRAM_PASSCODE

The malware also supports several command-line arguments to control its execution behavior, including background persistence and debugging:

--console
--version
--firefly
--db

Once active, Sync registers the infected machine by collecting the motherboard serial number, CPU ID, System UUID, BIOS serial number, and domain name. It hashes this combined string using SHA-256 to create a unique sysmarker. The malware then aggressively hunts for the Telegram tdata folder across standard directories, Microsoft Store paths, and even performs an extended drive search if the scan_portable setting is enabled by the C2 server.

If standard file access is blocked, Sync abuses Windows privileges to force extraction. It attempts to open files using the CreateFileW function with the FILE_FLAG_BACKUP_SEMANTICS parameter. If that fails, it leverages the Shadow Copy service, and as a last resort, uses the Robocopy utility in backup mode. Once the tdata is secured, Sync authenticates via the Telegram API to silently exfiltrate chat logs, member lists, and media files under 250MB.

The second module, Still Audio, focuses entirely on covert voice surveillance. Upon launch, it extracts the libmp3lame.dll library to encode captured audio and creates a background service named auxhost. To ensure it can always reach its operators, Still Audio employs a Dead Drop Resolver technique. If the primary C2 server is unreachable for three days, it pulls a backup address from a specific GitHub repository.

The backup URL is Base64-encoded and encrypted using the Blowfish algorithm in ECB mode. The attackers hardcoded the decryption key directly into the malware:

5c8e153228edd3c6cbf75684

To detect when a victim is speaking, the implant uses a Root Mean Square (RMS) algorithm for Voice Activity Detection (VAD). If the audio signal surpasses the vad_threshold (defaulted to 02), recording begins. It automatically stops after a max_silence_duration of 320 samples, which equates to roughly 7 milliseconds of silence on a standard 44.1kHz headset.

Armored Likho has diversified its infrastructure to evade detection, utilizing hosting providers across ASNs 149440, 202448, and 215311. The group registers domains that mimic legitimate Windows services, such as tg4service[.]com, srwinservice[.]com, screenserv[.]com, and windowserv[.]net. Despite these new domains, Kaspersky researchers confirmed attribution based on identical dropper architectures, shared Blowfish encryption keys, and the exact PowerShell commands used to generate the sysmarker hash in older AquilaRAT samples.

The shift to Rust is a calculated move by Armored Likho to evade traditional signature-based detection, leveraging Tokio's asynchronous nature for high-speed, concurrent data exfiltration. However, the most striking detail of this campaign is the Audio module's brazen lack of stealth at the operating system level. Instead of deploying complex rootkits to hide its microphone usage, the malware simply registers itself as "Intel Audio" (running as IntAudio.exe) in the standard Windows privacy settings.

This tactic highlights a critical blind spot in modern enterprise security. Attackers are pairing sophisticated network evasion - like Blowfish-encrypted Dead Drop Resolvers hosted on GitHub - with shockingly simple social engineering at the local OS level. They are betting entirely on user fatigue, assuming victims will ignore a microphone indicator if the process name looks vaguely like a legitimate hardware driver. Organizations must move beyond strictly monitoring network traffic and begin actively auditing local hardware access logs and application permissions to catch these "hiding in plain sight" techniques.