# Armored Likho Deploys 'Still Toolkit' to Hijack Telegram Sessions and Eavesdrop on Users

> Kaspersky researchers uncover the Still Toolkit, a new Rust-based malware by Armored Likho designed to hijack Telegram sessions and record covert audio.

- Canonical URL: https://coreiten.com/en/article/armored-likho-deploys-still-toolkit-to-hijack-telegram-sessions-and-eavesdrop-on-users
- Language: en
- Section: Telegram
- Author: Sami
- Published: 2026-08-15T14:03:14+03:00
- Modified: 2026-08-15T14:03:14+03:00
- Publisher: CoreITen (https://coreiten.com)
- Keywords: Armored Likho, Still Toolkit, Telegram session hijacking, Still Sync, Still Audio, tdata theft, Kaspersky threat report, Rust malware

---

A sophisticated cyber-espionage group known as Armored Likho (also tracked as Eagle Werewolf) has significantly escalated its attacks on Telegram users, deploying a new Rust-based malware arsenal dubbed the Still Toolkit. According to a new report from Kaspersky, the campaign targets private individuals, government sectors, and IT corporations in Russia. The attackers are utilizing a fake donation application as bait to quietly install two highly specialized implants: Still Sync, designed to hijack Telegram sessions, and Still Audio, a covert eavesdropping tool.

The infection chain begins with a deceptive dropper built on the [Tokio](https://github.com/tokio-rs/tokio) framework. Once a victim enters a password provided by the attackers, the app displays a functional catalog of donatable items pulled from the `orderapiserver[.]info` domain. While the user browses, the dropper silently decrypts and executes the Still Toolkit payload in the background, utilizing the same multi-part encryption format seen in the group's previous AquilaRAT campaigns.

### Still Sync: Automating Telegram Data Theft

The primary component, Still Sync, is an asynchronous Rust application that communicates with its command-and-control (C2) server over gRPC, serializing messages via [FlatBuffers](https://github.com/google/flatbuffers). Before initiating malicious activity, the implant pulls configuration parameters from specific environment variables:

```bash
STILL_SYNC_ADDR
STILL_SEND_PATH
STILL_TELEGRAM_PASSCODE
```

The malware also supports several command-line arguments to control its execution behavior, including background persistence and debugging:

```bash
--console
--version
--firefly
--db
```

Once active, Sync registers the infected machine by collecting the motherboard serial number, CPU ID, System UUID, BIOS serial number, and domain name. It hashes this combined string using SHA-256 to create a unique `sysmarker`. The malware then aggressively hunts for the Telegram `tdata` folder across standard directories, Microsoft Store paths, and even performs an extended drive search if the `scan_portable` setting is enabled by the C2 server.

If standard file access is blocked, Sync abuses Windows privileges to force extraction. It attempts to open files using the `CreateFileW` function with the `FILE_FLAG_BACKUP_SEMANTICS` parameter. If that fails, it leverages the Shadow Copy service, and as a last resort, uses the Robocopy utility in backup mode. Once the `tdata` is secured, Sync authenticates via the Telegram API to silently exfiltrate chat logs, member lists, and media files under 250MB.

### Still Audio: Eavesdropping via Dead Drop Resolvers

The second module, Still Audio, focuses entirely on covert voice surveillance. Upon launch, it extracts the `libmp3lame.dll` library to encode captured audio and creates a background service named `auxhost`. To ensure it can always reach its operators, Still Audio employs a Dead Drop Resolver technique. If the primary C2 server is unreachable for three days, it pulls a backup address from a specific GitHub repository.

The backup URL is Base64-encoded and encrypted using the Blowfish algorithm in ECB mode. The attackers hardcoded the decryption key directly into the malware:

```bash
5c8e153228edd3c6cbf75684
```

To detect when a victim is speaking, the implant uses a Root Mean Square (RMS) algorithm for Voice Activity Detection (VAD). If the audio signal surpasses the `vad_threshold` (defaulted to 02), recording begins. It automatically stops after a `max_silence_duration` of 320 samples, which equates to roughly 7 milliseconds of silence on a standard 44.1kHz headset.

### Infrastructure and Evasion Tactics

Armored Likho has diversified its infrastructure to evade detection, utilizing hosting providers across ASNs 149440, 202448, and 215311. The group registers domains that mimic legitimate Windows services, such as `tg4service[.]com`, `srwinservice[.]com`, `screenserv[.]com`, and `windowserv[.]net`. Despite these new domains, Kaspersky researchers confirmed attribution based on identical dropper architectures, shared Blowfish encryption keys, and the exact PowerShell commands used to generate the `sysmarker` hash in older AquilaRAT samples.

### The Audacity of "Intel Audio" and the Rust Revolution

The shift to Rust is a calculated move by Armored Likho to evade traditional signature-based detection, leveraging Tokio's asynchronous nature for high-speed, concurrent data exfiltration. However, the most striking detail of this campaign is the Audio module's brazen lack of stealth at the operating system level. Instead of deploying complex rootkits to hide its microphone usage, the malware simply registers itself as "Intel Audio" (running as `IntAudio.exe`) in the standard Windows privacy settings.

This tactic highlights a critical blind spot in modern enterprise security. Attackers are pairing sophisticated network evasion - like Blowfish-encrypted Dead Drop Resolvers hosted on GitHub - with shockingly simple social engineering at the local OS level. They are betting entirely on user fatigue, assuming victims will ignore a microphone indicator if the process name looks vaguely like a legitimate hardware driver. Organizations must move beyond strictly monitoring network traffic and begin actively auditing local hardware access logs and application permissions to catch these "hiding in plain sight" techniques.

## Sources

- [securelist.com](https://securelist.com/armored-likho-still-toolkit/121033/)