New Still Toolkit for Armored Likho
Kaspersky GReAT has identified a new cyber-espionage campaign by the Armored Likho group, also tracked as Eagle Werewolf, that was active in May 2026. The campaign targets Russian victims across corporate, education, IT, and public sector or government organizations, with initial infection delivered through a fake donation app.
The most significant addition is a new Rust-based implant suite the researchers call the Still Toolkit. It comprises three components: Still Sync, which collects and registers system information; Still Audio, which handles eavesdropping; and the main Still Toolkit module. The tools are built on top of the group’s existing AquilaRAT and use Telegram Desktop or its API for command-and-control. Kaspersky products detect the implants as Trojan.Win64.Agent.* and HEUR:Backdoor.Win32.Generic.
The Still Toolkit components
Still Sync is the registration component. It gathers system information from the target, concatenates the collected fields into a single colon-delimited string, and hashes the result with SHA-256. The hash is stored under the key sysmarker. Sync then serializes the full package—including the agent version—and POSTs it to /still.rpc.Sync/RegisterMachine. The same SHA-256 hashing scheme is used across other Armored Likho tools, including AquilaRAT.
Still Audio is the eavesdropping module. It handles audio capture on the compromised host, giving the group a dedicated channel for microphone-based surveillance alongside the Telegram data collection.
The main Still Toolkit module orchestrates the other two components. It manages the lifecycle of Sync and Audio, coordinating when each runs and how their output is relayed back through the Telegram C2 channel.
All three components are written in Rust, replacing the Python and Go builds the group has used in prior campaigns. The Rust rewrite reduces external dependencies and tightens the codebase, which is notable given the group’s earlier reliance on PyArmor-obfuscated Python and a Go rewrite with fewer external dependencies.
Telegram data collection
Still Sync pulls Telegram Desktop or API data directly from the victim. It gathers the relevant fields, concatenates them into a single string using a colon as the separator, and hashes the result with SHA-256. The digest is stored under the sysmarker key. The same SHA-256 hashing scheme is used across other Armored Likho tools, including AquilaRAT, so the group reuses the same fingerprinting logic across its implant suite.
Eavesdropping with Still Audio
Still Audio is the eavesdropping module in the Still Toolkit. It captures audio directly from the victim’s microphone on the compromised host, giving Armored Likho a dedicated channel for microphone-based surveillance that runs alongside the Telegram data collection handled by Still Sync.
The component is written in Rust, consistent with the rest of the toolkit. It sits next to Still Sync, which handles system registration, and the main Still Toolkit module that orchestrates both. Once deployed, the group can listen in on the victim’s system without relying on the Telegram C2 channel for the audio stream itself.
Attribution and infrastructure
Kaspersky attributes the campaign to Armored Likho with high confidence, citing code-level overlap with the group’s February 2026 deployment. The match is strongest in the dropper, where both campaigns use the Tauri library to build the GUI and share the same system-information collection logic. The same SHA-256 hashing scheme for the sysmarker key appears in AquilaRAT, which the group has used in prior campaigns.
The infrastructure footprint is consistent with the group’s usual pattern. The six domains follow the same naming convention seen in earlier Armored Likho operations: service[.]com, screenserv[.]com, windowserv[.]net, managementapiservice[.]com, service8date[.]com, and updateservs[.]com. The hosting providers behind these domains overlap with those used in the February campaign, which is what gives the attribution its weight beyond the code match.
Key points
- New Rust-based Still Toolkit includes Still Sync for system info and Telegram data collection, and Still Audio for eavesdropping.
- Initial infection uses a fake donation app targeting Russian private individuals and organizations across corporations, public sector, IT, and education.
- Still Sync collects system info, hashes it with SHA-256 under the sysmarker key, and POSTs to /still.rpc.Sync/RegisterMachine.
- Kaspersky detects the malware as Trojan.Win64.Agent.* and HEUR:Backdoor.Win32.Generic.
- Attribution is high-confidence based on identical dropper architecture, Tauri GUI, and infrastructure overlap with February 2026 campaign.