Armored Likho's new Rust kit goes after Telegram sessions, then the microphone

Kaspersky's Securelist team says that in May 2026 it found a new Armored Likho espionage campaign in Russia whose most consequential component is not really about the machine: it steals Telegram session data to get ongoing access to the victim's account, then reads chat logs and media through the Telegram API ^[1][5]. The same toolkit carries a second implant that watches the incoming audio stream, detects when someone is speaking, records the conversation and ships it to a command-and-control server ^[6].

The group, also tracked as Eagle Werewolf, hit private individuals and organizations across Russian industry, including major corporations, the public sector, IT and education, according to Securelist ^[1]. The bait was an app impersonating a donation service, and researchers collected several samples posing as apps from different Russian foundations; how the app reached victims is still unknown ^[2][13]. That lure is not new for this crew. Securelist has documented Armored Likho in November 2024 and in February and July 2026, with the November and February waves using droppers disguised as documents and apps tied to Starlink activation or fundraising ^[8]. By the vendor's count that is at least four dated campaigns across a 20-month span ^[17], with donation and fundraising themes recurring in at least three of them ^[18].

The dropper is written in Rust on the Tauri framework and has a working graphical interface: a login form that expects a password the attackers presumably handed to the target, then a browsable catalog of donatable items pulled live from orderapiserver[.]info via its public/categories and public/products endpoints ^[10][11]. While the mark scrolls the catalog, the dropper decrypts and launches the next stage in the background ^[11]. The decryption and staging mechanism has not changed since February ^[12]. The password gate is the operationally interesting part: a sample that will not unpack without an attacker-supplied credential also will not unpack in an automated pipeline that does not have it ^[19].

The new material is the Still Toolkit, two Rust components named Still Sync and Still Audio ^[4]. Sync is asynchronous, built on Tokio, talks gRPC, serializes with FlatBuffers, and picks HTTP or HTTPS based on the C2 URL it is given ^[14]. Its configuration arrives in environment variables: STILL_SYNC_ADDR, defaulting to https://tg4service[.]com:443; STILL_SEND_PATH, the path to the Telegram tdata folder; and STILL_TELEGRAM_PASSCODE, the password for decrypting tdata when local Telegram encryption is on ^[15]. That third variable is the tell. The operators built in a slot for the victim's local Telegram passcode, which means they expect to arrive with it in hand rather than settle for whatever is readable on disk ^[20]. Endpoint persistence is almost an afterthought by comparison: run without --console and the implant registers a TReload service ^[16]. Kaspersky detects the family as Trojan.Win64.Agent.* and HEUR:Backdoor.Win32.Generic ^[7].

Watch three things. Whether the distribution channel for the fake donation apps surfaces, since a password-gated installer implies targeted delivery ^[13][10]. Whether tg4service[.]com and the orderapiserver[.]info catalog API show up in unrelated intrusions. And whether incident response for this class of compromise starts including forced Telegram session invalidation, because reimaging a host does nothing to a session token already exfiltrated ^[5].