[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZXczZtxEXesbvWhImBGVBOpSUw99r6Cp97YU8ckE_9c":3,"$fxBlGag7AcZRg7cX9fMeREccOpejpPrLbnqf0-LhIWk4":67},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":64,"created_at":65,"updated_at":66,"published_at":36},"armored-likho-unveils-rust-based-still-toolkit-for-russian-cyber-espionage","Armored Likho Unveils Rust-Based Still Toolkit for Russian Cyber-Espionage","Kaspersky GReAT reveals new Still Sync and Still Audio implants that harvest Telegram data and eavesdrop on Russian victims via a fake donation app.","Armored Likho (Eagle Werewolf) deployed a new Rust-based Still Toolkit in May 2026, using a fake donation app to infect Russian victims and collect Telegram data plus audio eavesdropping.",[10,11,12,13,14,15],"Armored Likho","Eagle Werewolf","Still Toolkit","Rust","Telegram","cyber-espionage","# Armored Likho Unveils Rust-Based Still Toolkit for Russian Cyber-Espionage\n\n*Kaspersky GReAT reveals new Still Sync and Still Audio implants that harvest Telegram data and eavesdrop on Russian victims via a fake donation app.*\n\n**Tags:** `Armored Likho` `Eagle Werewolf` `Still Toolkit` `Rust` `Telegram` `cyber-espionage`\n\n> Armored Likho (Eagle Werewolf) deployed a new Rust-based Still Toolkit in May 2026, using a fake donation app to infect Russian victims and collect Telegram data plus audio eavesdropping.\n\n---\n\n## New Still Toolkit for Armored Likho\n\nKaspersky GReAT has identified a new cyber-espionage campaign by the Armored Likho group, also tracked as Eagle Werewolf, that was active in May 2026. The campaign targets Russian victims across corporate, education, IT, and public sector or government organizations, with initial infection delivered through a fake donation app.\n\nThe most significant addition is a new Rust-based implant suite the researchers call the Still Toolkit. It comprises three components: Still Sync, which collects and registers system information; Still Audio, which handles eavesdropping; and the main Still Toolkit module. The tools are built on top of the group’s existing AquilaRAT and use Telegram Desktop or its API for command-and-control. Kaspersky products detect the implants as Trojan.Win64.Agent.* and HEUR:Backdoor.Win32.Generic.\n\n## The Still Toolkit components\n\nStill Sync is the registration component. It gathers system information from the target, concatenates the collected fields into a single colon-delimited string, and hashes the result with SHA-256. The hash is stored under the key `sysmarker`. Sync then serializes the full package—including the agent version—and POSTs it to `\u002Fstill.rpc.Sync\u002FRegisterMachine`. The same SHA-256 hashing scheme is used across other Armored Likho tools, including AquilaRAT.\n\nStill Audio is the eavesdropping module. It handles audio capture on the compromised host, giving the group a dedicated channel for microphone-based surveillance alongside the Telegram data collection.\n\nThe main Still Toolkit module orchestrates the other two components. It manages the lifecycle of Sync and Audio, coordinating when each runs and how their output is relayed back through the Telegram C2 channel.\n\nAll three components are written in Rust, replacing the Python and Go builds the group has used in prior campaigns. The Rust rewrite reduces external dependencies and tightens the codebase, which is notable given the group’s earlier reliance on PyArmor-obfuscated Python and a Go rewrite with fewer external dependencies.\n\n## Telegram data collection\n\nStill Sync pulls Telegram Desktop or API data directly from the victim. It gathers the relevant fields, concatenates them into a single string using a colon as the separator, and hashes the result with SHA-256. The digest is stored under the `sysmarker` key. The same SHA-256 hashing scheme is used across other Armored Likho tools, including AquilaRAT, so the group reuses the same fingerprinting logic across its implant suite.\n\n## Eavesdropping with Still Audio\n\nStill Audio is the eavesdropping module in the Still Toolkit. It captures audio directly from the victim’s microphone on the compromised host, giving Armored Likho a dedicated channel for microphone-based surveillance that runs alongside the Telegram data collection handled by Still Sync.\n\nThe component is written in Rust, consistent with the rest of the toolkit. It sits next to Still Sync, which handles system registration, and the main Still Toolkit module that orchestrates both. Once deployed, the group can listen in on the victim’s system without relying on the Telegram C2 channel for the audio stream itself.\n\n## Attribution and infrastructure\n\nKaspersky attributes the campaign to Armored Likho with high confidence, citing code-level overlap with the group’s February 2026 deployment. The match is strongest in the dropper, where both campaigns use the Tauri library to build the GUI and share the same system-information collection logic. The same SHA-256 hashing scheme for the `sysmarker` key appears in AquilaRAT, which the group has used in prior campaigns.\n\nThe infrastructure footprint is consistent with the group’s usual pattern. The six domains follow the same naming convention seen in earlier Armored Likho operations: `service[.]com`, `screenserv[.]com`, `windowserv[.]net`, `managementapiservice[.]com`, `service8date[.]com`, and `updateservs[.]com`. The hosting providers behind these domains overlap with those used in the February campaign, which is what gives the attribution its weight beyond the code match.\n\n## Key points\n\n- New Rust-based Still Toolkit includes Still Sync for system info and Telegram data collection, and Still Audio for eavesdropping.\n- Initial infection uses a fake donation app targeting Russian private individuals and organizations across corporations, public sector, IT, and education.\n- Still Sync collects system info, hashes it with SHA-256 under the sysmarker key, and POSTs to \u002Fstill.rpc.Sync\u002FRegisterMachine.\n- Kaspersky detects the malware as Trojan.Win64.Agent.* and HEUR:Backdoor.Win32.Generic.\n- Attribution is high-confidence based on identical dropper architecture, Tauri GUI, and infrastructure overlap with February 2026 campaign.\n\n## Further reading & sources\n\n- [New Armored Likho tools target Telegram and eavesdropping | Securelist](https:\u002F\u002Fsecurelist.com\u002Farmored-likho-still-toolkit\u002F121033) — Kaspersky Securelist\n- [Medium](https:\u002F\u002Fmedium.com\u002F@rst_cloud\u002Frst-ti-report-digest-06-jul-2026-b094bb1c520c)\n- [Medium](https:\u002F\u002Fmedium.com\u002F@rst_cloud\u002Frst-ti-report-digest-17-aug-2026-1ac59e1f7a17)\n- [RST TI Report Digest: 24 Aug 2026](https:\u002F\u002Fmedium.com\u002F@rst_cloud\u002Frst-ti-report-digest-24-aug-2026-5f4ab2af18b9)\n- [BusySnake Stealer Slithers Into Critical Infrastructure Networks](https:\u002F\u002Fwww.darkreading.com\u002Fcyberattacks-data-breaches\u002Fbusysnake-infostealer-critical-infrastructure-networks%250A)\n- [July 2026 Threat Trend Report on APT Groups - ASEC](https:\u002F\u002Fasec.ahnlab.com\u002Fen\u002F95040)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Farmored-likho-unveils-rust-based-still-toolkit-for-russian-cyber-espionage.png?v=9fe694b255",{"iocs":19,"actors":31,"malware":38,"timeline":48,"technologies":57},[20,23,25,27,29],{"type":21,"value":22},"domain","screenserv[.]com",{"type":21,"value":24},"windowserv[.]net",{"type":21,"value":26},"managementapiservice[.]com",{"type":21,"value":28},"service8date[.]com",{"type":21,"value":30},"updateservs[.]com",[32],{"url":33,"name":10,"slug":34,"type":35,"origin":36,"motivation":37},"\u002Fthreat-groups\u002Farmored-likho","armored-likho","unknown",null,"cyber-espionage and financially motivated attacks",[39,41,43,45,46],{"name":40},"Still Sync",{"name":42},"Still Audio",{"name":44},"AquilaRAT",{"name":12},{"name":47},"BusySnake Stealer",[49,53],{"date":50,"event":51,"description":52},"2026-05","Campaign Discovery","Discovery of new cyber-espionage campaign.",{"date":54,"event":55,"description":56},"2026-07-06","Disclosure","Kaspersky discloses Armored Likho and BusySnake Stealer",[58,60,62],{"vendor":14,"product":59},"Telegram Desktop \u002F API",{"vendor":61,"product":47},"Kaspersky",{"vendor":61,"product":63},"PyArmor Pro","threat_actor_activity","2026-08-29T07:24:36.266583+00:00","2026-10-16T12:29:04.947617+00:00",{"articles":68},[69,79,92,105],{"slug":70,"title":71,"summary":72,"tags":73,"hero_image_url":77,"story_type":64,"created_at":78},"kaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz","Kaspersky Unveils Armored Likho APT Using BusySnake Stealer Against Russian, Brazilian, and Kazakh Government and Critical Infrastructure","Kaspersky has identified a new APT group, Armored Likho, running a multi-stage spear-phishing campaign that drops a previously undocumented Python infostealer called BusySnake Stealer to steal credentials, browser data, and documents from government and critical infrastructure targets in Russia, Brazil, and Kazakhstan.",[10,47,61,74,75,76],"APT","spear-phishing","critical infrastructure","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fkaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz.png?v=1bc6e1f6d4","2026-09-19T12:06:09.947355+00:00",{"slug":80,"title":81,"summary":82,"tags":83,"hero_image_url":90,"story_type":64,"created_at":91},"russian-state-actors-exploit-exposed-ip-cameras-to-track-nato-troop-movements-in","Russian State Actors Exploit Exposed IP Cameras to Track NATO Troop Movements in Ukraine","The Netherlands' AIVD and MIVD released a joint advisory warning that Russian state actors are systematically exploiting publicly exposed IP cameras to track NATO troop and supply movements in the ongoing Ukraine war.",[84,85,86,87,88,89],"Russia","IP Camera","NATO","Ukraine","AIVD","MIVD","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Frussian-state-actors-exploit-exposed-ip-cameras-to-track-nato-troop-movements-in.png?v=74b95987f5","2026-09-30T07:07:04.966623+00:00",{"slug":93,"title":94,"summary":95,"tags":96,"hero_image_url":103,"story_type":64,"created_at":104},"fancy-bear-ai-enabled-attacks-surge-89-in-crowdstrike-2026-report","Fancy Bear AI-Enabled Attacks Surge 89% in CrowdStrike 2026 Report","CrowdStrike's 2026 Global Threat Report shows Fancy Bear (APT28) AI-enabled adversary activity up 89% year-over-year, eCrime average breakout time at 29 minutes, and GenAI prompt injection confirmed at 90+ organizations.",[97,98,99,100,101,102],"Fancy Bear","APT28","CrowdStrike","LLM malware","GenAI prompt injection","eCrime","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffancy-bear-ai-enabled-attacks-surge-89-in-crowdstrike-2026-report.png?v=f7ed8c119c","2026-09-29T12:06:38.382267+00:00",{"slug":106,"title":107,"summary":108,"tags":109,"hero_image_url":115,"story_type":64,"created_at":116},"palo-alto-unit-42-405-ai-enabled-malware-samples-show-12-in-production","Palo Alto Unit 42: 405 AI-enabled malware samples show 12 in production","Palo Alto Networks Unit 42 analyzed 405 AI-enabled malware samples and found the space is dominated by PoC and researcher code, with only 12 samples hitting production endpoints across five distinct malware families.",[110,111,112,113,114],"AI malware","FunkSec","Palo Alto Unit 42","ransomware","LLM","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpalo-alto-unit-42-405-ai-enabled-malware-samples-show-12-in-production.png?v=efb3f6f578","2026-09-26T12:10:59.266452+00:00"]