Researchers at Kaspersky say a cyber-espionage group they track as Armored Likho has quietly widened what it can take from a compromised machine. Beyond files and credentials, the group's newest tools lift a victim's Telegram session and switch on the computer's microphone to record whatever is said in the room.
The campaign was discovered in May 2026 and is described in a technical report by Kaspersky's Konstantin Isakov. The targets are almost all in Russia: mostly private individuals, but also large companies, public sector bodies, IT firms and educational institutions. The group is also known as Eagle Werewolf, and we covered its earlier wave of AI-assisted malware loaders in July.
A fake charity app that hides a dropper
The bait is an application that pretends to be a donation service, written in Rust on the Tauri framework so it looks and behaves like an ordinary desktop app. It asks for a password, presumably one the attackers supplied to the target, then shows a browsable catalogue of items to donate that it pulls live from orderapiserver[.]info. While the user reads that catalogue, the app quietly decrypts and launches the real payload in the background. Kaspersky says it has not yet established how the app itself is distributed.
What the Still Toolkit does
The payload is a new pair of Rust implants Kaspersky calls the Still Toolkit.
Still Sync goes after Telegram Desktop. It hunts for the tdata folder, the local store that holds a logged-in session, and copies it out. That session data is effectively a key to the account, so with it the attackers can use the Telegram API to pull chat, group and channel names, member lists, message histories and media files up to 250MB. If the files are locked by the running app, Sync falls back on three tricks that abuse a Windows backup privilege: opening the files with backup semantics, reading them out of a Shadow Copy, or copying them with Robocopy in backup mode.
Still Audio is the eavesdropper. It listens to the microphone and uses a simple loudness measurement to decide when somebody is speaking, keeps a short pre-buffer so it does not lose the first words, encodes the recording as MP3 and uploads it. It installs itself as a Windows service named auxhost and, in the sample analysed, ran as IntAudio.exe and appeared in the Windows list of apps using the microphone as "Intel Audio". If its command server stays unreachable for three days, it fetches a fresh address from an encrypted blob hidden in a forked GitHub repository at hxxps://raw.githubusercontent[.]com/mmarln/pi-mono/refs/heads/main/packages/pods/src/array12[.]json.
Kaspersky attributes the campaign to Armored Likho with high confidence, citing an identical dropper architecture to the group's February campaign, the same encryption key and device-fingerprinting logic seen in its AquilaRAT backdoor, and reuse of the same hosting providers and service-imitating domain names.
What you should do
Kaspersky detects the implants as Trojan.Win64.Agent.* and HEUR:Backdoor.Win32.Generic. Defenders in Russia, and anyone supporting staff there, should check the Windows microphone list for entries nobody installed, look for services named auxhost or TReload, and review Telegram's active-session list for unrecognised devices. Kaspersky's published indicators include the domains orderapiserver[.]info, tg4service[.]com, srwinservice[.]com, screenserv[.]com, windowserv[.]net, managementapiservice[.]com, service8date[.]com and updateservs[.]com, and the dropper hashes C1D1EE16B92E6A138FFA048855F75D7D and 17674B250D8B422A50A86C9FF207186D.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.