In May 2026, we discovered a new cyber-espionage campaign by the Armored Likho group that targets private individuals and organizations across multiple Russian sectors, and the most notable development is a newly expanded set of implants written in Rust that steal Telegram sessions and perform covert audio surveillance.
Initial infection: a Tauri-built “donation” app dropper
The campaign begins with a fake application that mimics a donation service. The distribution method for that app remains unknown, but analysis of samples shows the dropper is written in Rust on top of the Tauri framework and includes a deceptive graphical catalog that queries orderapiserver[.]info via public/categories and public/products. After a user supplies a password, the dropper quietly decrypts and launches payloads in the background. Kaspersky notes the decryption-and-launch mechanism matches the February campaign’s implementation and that Kaspersky products detect these threats as Trojan.Win64.Agent.* and HEUR:Backdoor.Win32.Generic.
Still Sync: stealing Telegram tdata and exfiltrating chats and media
Still Sync is a Rust stealer whose declared aim is to exfiltrate Telegram session data (the tdata folder) and then use that data to log into the victim’s account via the Telegram API. Architecturally it is asynchronous (built on Tokio), communicates with its command-and-control (C2) over gRPC, serializes messages with FlatBuffers, and supports HTTP and HTTPS transports. The default C2 URL is https://tg4service[.]com:443, unless overridden by the STILL_SYNC_ADDR environment variable.
On launch Sync gathers system identifiers (motherboard serial, CPU ID, system UUID, BIOS serial, computer domain), concatenates them with colons, hashes the result with SHA-256, and stores the value as sysmarker. It registers to the C2 at /still.rpc.Sync/RegisterMachine and then retrieves per-host settings from /still.rpc.Sync/GetMachineSettings—settings that control whether scanning and Telegram data collection occur (enabled, scan_portable, fetch_telegram, download_channels).
Sync searches for tdata in standard and nonstandard locations (including the Microsoft Store path identified by a folder name containing TelegramMessenge and, if scan_portable is enabled, an extended search of C:\). Before sending file lists to /still.rpc.Sync/CheckFiles it will fall back to privilege-abuse methods if ordinary file access fails: opening files with CreateFileW and FILE_FLAG_BACKUP_SEMANTICS, creating and reading Shadow Copies, or using Robocopy in backup mode.
If fetch_telegram is enabled, Sync authenticates with the tdata, then collects user details (username, phone number, given and family name), dialog metadata (private chats, groups, channels and members), message dialogs (channels only if download_channels is on), and media files under 250MB.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleStill Audio: microphone surveillance implemented in Rust
Still Audio is a companion implant that records and exfiltrates voice when voice-activity criteria are met. Like Sync it uses environment variables to find its C2; STILL_AUDIO_SYNC_ADDR is preferred, then STILL_SYNC_ADDR, and finally the default https://srwinservice[.]com. The module can also use a Dead Drop Resolver fallback: if its server is unreachable for three days it pulls an encrypted, Base64-encoded URL from a GitHub page at hxxps://raw.githubusercontent[.]com/mmarln/pi-mono/refs/heads/main/packages/pods/src/array12.json. That entry is Blowfish-ECB encrypted with the key 5c8e153228edd3c6cbf75684—the same algorithm and key seen previously in AquilaRAT samples.
On startup Still Audio extracts an mp3 encoder library (libmp3lame.dll), optionally installs as a Windows service named auxhost, and writes logs to logfile.log. It registers to /still.rpc.Audio/RegisterAudioMachine and sends the list of available audio input devices. The server returns parameters including machine_id, vad_threshold (the sample’s default is recorded as 02), max_silence_duration (320 samples by default), max_buffer_size, and the active_device name.
Voice activity detection uses a Root Mean Square (RMS) calculation implemented in the implant itself. When RMS meets or exceeds the vad_threshold recording begins and is protected by a pre-buffer so the start of speech is preserved. A run of max_silence_duration low-RMS samples ends the recording—on a 44.1kHz device the sample defaults mean recording can stop after roughly 7ms of silence. Encoded with libmp3lame, recordings are POSTed to /tgfrg with a Client-Id header containing the machine_id. Notably, the implant’s microphone use can be visible in Windows: the sample examined saved as IntAudio.exe and showed up in the system list as “Intel Audio.”
Infrastructure, overlap with prior campaigns, and attribution to Armored Likho
The campaign uses a diverse set of domains and hosting providers—orderapiserver[.]info, tg4service[.]com, srwinservice[.]com, screenserv[.]com, windowserv[.]net, managementapiservice[.]com, service8date[.]com, and updateservs[.]com—registered at various dates and served from multiple ASNs (including 149440, 202448, and 215311). Kaspersky found no direct domain or IP overlap with the February campaign, but the infrastructures share hosting providers and naming patterns that mimic Windows services or update mechanisms.
Code-level overlaps tie the toolkit to Armored Likho activity documented in November 2024 and in February and July 2026: identical Tauri-based dropper architecture (including an ICRYPTMP header and multipart encryption format), the same Blowfish algorithm and key used by AquilaRAT and Still Audio, identical sysmarker-generation logic (even matching PowerShell collection commands), and substantial infrastructure patterns. Kaspersky states it is highly confident the Armored Likho group is behind this campaign.
What this means for private individuals, enterprise defenders, and educational institutions
- Private individuals: the primary targets in this campaign are users in Russia; the immediate signals to watch are unsolicited “donation” apps that request a password and the presence of unfamiliar binaries (for example IntAudio.exe) that may appear in the system microphone list.
- Enterprise and government security teams: the campaign’s ability to harvest tdata and then pull chats and media—combined with an audio-surveillance implant—means a single compromise can expose messaging histories and live-room audio; C2 domains, the sysmarker hashing behavior, and the Kaspersky detection names provide concrete indicators to hunt for.
- Educational institutions and IT companies: the threat affects a wide range of sectors in Russia, including IT and education, so administrators should note the campaign’s use of portable-search options and backup-privilege fallbacks when reviewing endpoint telemetry and access logs.
Armored Likho’s push into specialized, Rust-based modules that work together—telegram-session theft and targeted microphone surveillance—marks a tangible expansion of capability designed for long-term intelligence gathering. One critical fact remains: the app distribution method for the initial “donation” lure has not been established in the samples reviewed, leaving a key vector of operational tradecraft unresolved.
Read the original Kaspersky analysis: https://securelist.com/armored-likho-still-toolkit/121033/
