Armored Likho Unveils New Cyber-Espionage Toolkit Targeting Telegram
In May 2026, Kaspersky experts uncovered a new cyber-espionage campaign attributed to the Armored Likho group, also known as Eagle Werewolf. This campaign targets individuals and organizations across various sectors in Russia, including major corporations and educational institutions. The attackers utilize a deceptive application that masquerades as a donation service to lure victims. However, the most concerning aspect of this operation is the advanced toolkit employed for cyber-espionage.
The newly identified toolkit, named the Still Toolkit, is written in Rust and comprises two main components: Still Sync and Still Audio. Still Sync is designed to steal Telegram session data, allowing attackers to access victims' accounts and extract chat logs, media files, and other sensitive information. The second component, Still Audio, functions as an implant for covert audio surveillance, capable of recording conversations and transmitting the audio to a command-and-control server.
The infection process begins with the distribution of an application that mimics a legitimate donation service. The exact method of distribution remains unclear, but Kaspersky researchers have analyzed several samples posing as apps from various Russian foundations. Once launched, the app requests a password from the user, which, if entered, leads to a catalog of items for donation. In the background, the app decrypts and executes the malicious payload.
The Still Toolkit's architecture reveals a sophisticated design. Still Sync communicates with the command-and-control server using gRPC and supports both HTTP and HTTPS protocols. Upon activation, it collects system information and registers the device with the server, which then provides configuration settings for subsequent malicious activities.
In addition to stealing Telegram session data, Still Sync can gather extensive user information from the messaging app. The toolkit's capabilities are further enhanced by Still Audio, which analyzes audio streams for speech and records conversations based on specific conditions. This module also employs a registration process similar to that of Still Sync, ensuring effective communication with the command-and-control server.
The campaign demonstrates a significant evolution in Armored Likho's cyber-espionage toolkit, showcasing new modules that not only enhance their data collection capabilities but also indicate a strategic effort to improve intelligence-gathering methods. The attackers are leveraging multiple communication channels, making their operations more effective and harder to detect.
Kaspersky's analysis highlights the ongoing threat posed by the Armored Likho group, which continues to adapt and expand its toolkit to target users in Russia. The findings underscore the importance of vigilance against such sophisticated cyber threats, particularly as they evolve to exploit new vulnerabilities and communication platforms.
