--- title: "New Armored Likho tools target Telegram and eavesdropping" url: https://daily.dev/posts/new-armored-likho-tools-target-telegram-and-eavesdropping-xtg4q18ob source_url: https://securelist.com/armored-likho-still-toolkit/121033 type: article source: "Securelist" published: 2026-08-13T08:02:45.562Z updated: 2026-08-13T08:03:20.363Z tags: ["security", "rust", "malware", "telegram"] reading_time: 13 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # New Armored Likho tools target Telegram and eavesdropping **[Securelist](https://daily.dev/sources/securelist)** · 13 min read · 0 upvotes · 0 comments ## Summary Kaspersky researchers detail a new cyber-espionage campaign by the Armored Likho group (aka Eagle Werewolf), which targets individuals and organizations in Russia via a fake fundraising app built with Tauri and Rust. The dropper deploys a new Rust-based toolkit called Still Toolkit, consisting of Still Sync (which steals Telegram session data and pulls chats, media, and contacts via the Telegram API) and Still Audio (which performs covert audio surveillance using RMS-based voice activity detection and sends recordings to a C2 server). The report covers infection chain, C2 communication (gRPC, FlatBuffers), a Dead Drop Resolver fallback via GitHub, infrastructure overlaps with prior campaigns, and code-level attribution links to earlier AquilaRAT malware. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the Still Toolkit malware used by Armored Likho? Still Toolkit is a Rust-based cyber-espionage toolkit used by the Armored Likho (Eagle Werewolf) APT group, consisting of two components: Still Sync, which steals Telegram session data and pulls chats, media, and contacts via the Telegram API, and Still Audio, which covertly records conversations using voice activity detection and sends recordings to a command-and-control server. _Track how APT groups evolve their tooling and defend against them with security coverage on daily.dev._ ### How does the Still Audio malware detect and record voice conversations? Still Audio uses a Root Mean Square (RMS) based Voice Activity Detection algorithm implemented without third-party libraries, comparing signal power against a configurable vad_threshold (default 0.2). Recording starts once RMS meets the threshold, uses a pre-buffer to avoid losing the start of speech, and stops after max_silence_duration samples (default 320) fall below threshold, roughly 7ms of silence at 44.1kHz. _Stay ahead of emerging spyware techniques by following security research on daily.dev._ ### How does Still Audio malware obtain its command-and-control server address if the primary domain is unreachable? Still Audio falls back to the Dead Drop Resolver technique: if its C2 server is unreachable for three days, it fetches the current C2 URL from a GitHub repository (a fork of a popular project), where the address is Base64-encoded and encrypted with Blowfish in ECB mode using a hardcoded key, the same algorithm and key used in older AquilaRAT malware samples. _Follow evolving C2 evasion techniques and threat infrastructure trends on daily.dev._ ## Similar posts on daily.dev - [Armored Likho's new weapon: BusySnake Stealer](https://daily.dev/posts/armored-likho-s-new-weapon-busysnake-stealer-jlglbr4ad) · Securelist · 0 upvotes · 0 comments - [BusySnake Stealer Slithers into Critical Infrastructure Networks](https://daily.dev/posts/busysnake-stealer-slithers-into-critical-infrastructure-networks-dcqwywayo) · Dark Reading · 0 upvotes · 0 comments - [New "Cavalry Werewolf" Attack Hits Russian Agencies with FoalShell and StallionRAT](https://daily.dev/posts/new-cavalry-werewolf-attack-hits-russian-agencies-with-foalshell-and-stallionrat-xweiaurfi) · The Hacker News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#rust](https://daily.dev/tags/rust), [#malware](https://daily.dev/tags/malware), [#telegram](https://daily.dev/tags/telegram) [View this post on daily.dev](https://daily.dev/posts/new-armored-likho-tools-target-telegram-and-eavesdropping-xtg4q18ob)