Armored Likho APT Deploys Rust-Based Still Toolkit for Espionage

Since May 2026, the Armored Likho (also known as Eagle Werewolf) group has been conducting a targeted cyber-espionage campaign against Russian organizations in the public, IT, and education sectors. The attackers utilize a sophisticated Rust-based dropper built on the Tauri framework, masquerading as a donation service application. Once initialized, this dropper downloads and executes the 'Still Toolkit', a modular espionage suite designed for data exfiltration and persistent surveillance.

The toolkit consists of two primary implants: 'Still Sync', a stealer that targets Telegram session ('tdata') files and leverages the Telegram API for ongoing access to chat logs and media, and 'Still Audio', an implant dedicated to covert audio recording and speech analysis. The malware utilizes gRPC over HTTP/HTTPS with FlatBuffers serialization for command-and-control communication, employing techniques observed in previous campaigns such as machine registration via hardware-based system markers and persistent background services.

Attack Chain

1. Initial delivery of a Tauri-based dropper application masquerading as a legitimate Russian fundraising service.
2. Execution of the dropper, which displays a deceptive GUI and validates user input before decrypting the secondary payload.
3. The dropper retrieves product catalog data from the C2 domain 'orderapiserver[.]info' to maintain a legitimate appearance.
4. Decryption and execution of the Still Toolkit components (Still Sync and Still Audio) in the background.
5. Still Sync creates a persistent background service named 'TReload' to ensure long-term execution.
6. The implant performs system fingerprinting (CPU ID, BIOS/Motherboard serials) to generate a unique 'sysmarker' and registers the host with the C2 server 'tg4service[.]com'.
7. Still Sync targets the Telegram Desktop 'tdata' directory to extract authentication tokens, enabling unauthorized access to the victim's account via the Telegram API.
8. Still Audio implant initializes covert audio capture, performs local speech detection, and exfiltrates audio streams to the attacker-controlled C2.

Impact

The campaign facilitates unauthorized access to private corporate and personal Telegram communications, including potentially sensitive media and chat history, alongside real-time audio surveillance of the victim's environment. This poses a significant risk to organizational confidentiality, particularly for entities in the public and IT sectors where internal communications are critical.

Recommendation

• Block all traffic to the known C2 domains 'orderapiserver[.]info' and 'tg4service[.]com' at the network perimeter.
• Monitor for the creation of non-standard Windows services, specifically looking for the 'TReload' service name using Sysmon Event ID 1.
• Implement endpoint detection rules to identify execution of Tauri-based application installers from untrusted sources or unexpected locations.
• Audit endpoints for the presence of the hidden file 'bin' created by the Still Sync implant in the same directory as the executable.