Do Son 
At a glance
- Actor or group: Armored Likho (also known as Eagle Werewolf)
- Activity type: Cyber espionage and audio surveillance
- Targets or victims: Private individuals, government bodies, IT firms, and corporations in Russia
- Scale: Undisclosed number of Russian individuals and organizations
- Jurisdiction or law-enforcement status: Active espionage group; uncharged in this report
- Source: Kaspersky Labs
TL;DR
Kaspersky Labs discovered an espionage campaign conducted by the Armored Likho threat group. The group deployed a new set of cyber-espionage utilities known as the Armored Likho Still Toolkit. These implants steal Telegram account sessions and capture ambient microphone recordings.
What happened
In May 2026, researchers detected a cyber-espionage campaign using fake donation apps. The attackers created deceptive desktop software using Rust and the Tauri framework. When launched, the application displays a password login interface.
After the user enters a password, the interface loads a catalog of charitable items. Meanwhile, the software quietly unpacks malicious modules in the background. “During our research, we found a new cyber-espionage toolkit written in Rust: the Still Toolkit,” the researcher confirms.
The first component, Still Sync, targets Telegram desktop installations. It collects session credentials to gain unauthorized access to messaging accounts. The module uses the Tokio framework for asynchronous networking. It communicates over gRPC using FlatBuffers message serialization.
If standard folder access fails, the module abuses backup rights to read protected files. It can copy locked data using Shadow Copies or the Robocopy utility. Once connected, Still Sync extracts private chat history and downloads media files.
The second module, Still Audio, handles audio surveillance. “It analyzes the incoming audio stream, automatically detects speech, records conversations, and sends the recordings to a command-and-control server,” the analysis explains. The module embeds the libmp3lame library to compress captured voice data.
It uses Root Mean Square algorithms to detect spoken words. This mathematical approach lets the tool distinguish human voices from background noise. If local servers fail to answer, the implant uses a GitHub repository as a dead-drop resolver.
Who is behind it
Kaspersky researchers attribute this campaign to the Armored Likho group with high confidence. Analysts also track this threat actor under the name Eagle Werewolf.
The group has launched targeted operations since at least November 2024. Investigators identified significant code overlap between these new tools and older malware families. For example, the audio implant shares encryption routines with AquilaRAT.
Both tools use the exact same Blowfish encryption key to protect server URLs. Furthermore, the dropper architecture matches previous campaigns analyzed by researchers. The domain naming schemes also mimic standard Windows update services.
Impact or scale
The Armored Likho Still Toolkit campaign primarily affects targets across Russia. The attackers target government organizations, education entities, IT companies, and large enterprises. Many private individuals also encountered the malicious donation software.
The financial damage remains unquantified because the operators focus on intelligence gathering. However, the espionage risk is severe. By stealing Telegram session data, attackers bypass two-factor authentication protections.
Consequently, the operators monitor private conversations and steal confidential corporate files. The audio recording tool converts infected endpoints into active room bugs. Because the implants share common infrastructure and codebases, the threat actor built a durable espionage ecosystem.
What comes next or how readers can stay protected
Defenders expect the Armored Likho collective to continue expanding its toolset. Security teams must adjust monitoring systems to catch these modern implants.
Organizations should monitor endpoints for unusual background services like auxhost. Watch for unexpected processes accessing the system microphone in Windows settings. Endpoint detection tools should flag unusual gRPC network connections to external addresses.
Additionally, administrators should restrict user permissions to prevent the abuse of backup privileges. Users should avoid downloading untrusted applications from unverified sources. Always verify charitable software before entering passwords or executing installers.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
