In May 2026, researchers uncovered a new cyber-espionage campaign attributed to the Armored Likho group, also known as Eagle Werewolf. This campaign targets private individuals and organizations across various sectors in Russia, including major corporations, public sector entities, IT firms, and educational institutions. The attackers have significantly expanded their toolkit, introducing a new Rust-based suite called the Still Toolkit, which includes components for Telegram data exfiltration and covert audio surveillance.
The initial infection vector for this campaign involves a fake application disguised as a donation service. While the distribution method for this application remains unconfirmed, samples have been observed posing as apps from various Russian foundations. The application, developed in Rust using the Tauri framework, presents a graphical interface with a login form, presumably requiring a password provided by the attackers. Upon successful login, users are shown a catalog of items, with information pulled from `orderapiserver[.]info` via the `/public/categories` and `/public/products` endpoints, lending an appearance of legitimacy.
During this user interaction, the application functions as a dropper, decrypting and launching the next-stage payload in the background. This payload mechanism is consistent with Armored Likho's activities from February 2026. The newly identified Still Toolkit comprises two primary components: Still Sync and Still Audio.
Still Sync is a Rust-based stealer designed to exfiltrate Telegram session data. Beyond simply stealing session files, Still Sync can leverage the Telegram API to log into the victim's account and automatically retrieve chat logs, media files, and other information. The implant is an asynchronous application built with the Tokio library, communicating with its command-and-control (C2) server via gRPC and serializing messages with FlatBuffers. It supports both HTTP and HTTPS, determined by the C2 server URL, which defaults to `https://tg4service[.]com:443`.
Before initiating malicious activities, Still Sync retrieves configuration parameters from environment variables, including `STILL_SYNC_ADDR` for the C2 server address, `STILL_SEND_PATH` for the Telegram `tdata` path, and `STILL_TELEGRAM_PASSCODE` for decrypting encrypted Telegram data. It also supports command-line arguments such as `--console` for console execution, `--version` for version information, `--firefly` for trace monitoring and error logging to a hidden `bin` file, and `--db` for detailed debug logging.
Upon launch, Still Sync registers the infected device with the C2 server. It collects system information including the motherboard serial number, CPU ID, system UUID, BIOS serial number, and computer domain name. This data is combined, hashed with SHA-256 (a method also seen in other Armored Likho tools like AquilaRAT), and sent in a POST request to `/still.rpc.Sync/RegisterMachine`. The server responds with a `machine_id` for subsequent requests. Following registration, Still Sync requests settings from `/still.rpc.Sync/GetMachineSettings`, which include `enabled` to trigger malicious activity, `scan_portable` for extended `tdata` scanning, `fetch_telegram` to enable Telegram data extraction, and `download_channels` to control channel dialog exfiltration.
For Telegram data collection, Still Sync searches for the `tdata` folder in standard directories like `C:\Users\username\AppData\Roaming\Telegram Desktop\` and `C:\Users\username\AppData\Local\Packages\package_folder\LocalCache\Roaming\` (for the Microsoft Store version). If the `scan_portable` option is enabled, it also performs an extended search starting from `C:\`. The malware then sends a list of files from the `tdata` folder to the `/still.rpc.Sync/CheckFiles` endpoint. The server responds with a `snapshot_id` and a list of `present` files, allowing the C2 to avoid redundant data transfers. If standard file access methods fail, Still Sync attempts to abuse the `SeBackupPrivilege` to open files.
The second component, Still Audio, is an implant designed for covert audio surveillance. It actively analyzes the incoming audio stream, automatically detects speech, records conversations, and then transmits these recordings to the C2 server. This functionality enables the attackers to conduct ongoing eavesdropping on victims.
This campaign demonstrates a significant evolution in Armored Likho's capabilities, particularly with the introduction of the Still Toolkit. Previous activities by the group were documented in November 2024, and in February and July 2026, often using droppers disguised as documents or applications related to Starlink activation or fundraising. The current campaign shares similarities with the November 2024 and February 2026 campaigns in its use of fundraising lures. Cybersecurity products detect this threat as `Trojan.Win64.Agent.*` and `HEUR:Backdoor.Win32.Generic`.
