Reported by 3 outlets

Timeline

1. original reporting

   Armored Likho expands its cyber-espionage toolkit

   malware.news · 61d ago · August 13th, 2026

   In May 2026, we discovered a new cyber-espionage campaign by the Armored Likho group, also known as Eagle Werewolf, that targets private individuals and organizations across various industries in Russia, including major corporations, the public sector, IT, and education. The attackers used a fake app as bait that mimics a service for donations. However, the most interesting part of this campaign isn’t the initial infection method – it’s the malicious implants the attackers use for cyber-espionage. We’ve written previously about recent Armored Likho attacks, but our analysis shows that the campaign discussed below has more in common with the group’s activity from February . That said, the attackers have significantly expanded their arsenal. During our research, we found a new cyber-espionage toolkit written in Rust: the Still Toolkit . One of its components, Still Sync , steals Telegram session data to gain ongoing access to the victim’s account. With this stolen data, attackers can leverage the Telegram API to automatically pull chat logs, media files, and other information from the account. The second component, Still Audio , is an implant for covert audio surveillance. It analyzes the incoming audio

2. update from cyberpress.org

   Armored Likho Abuses GitHub as Backup C2 Channel for Audio Surveillance Malware

   cyberpress.org · 61d ago · August 13th, 2026

   The group used fake donation applications as bait, but its latest malware toolkit is the bigger concern. The attackers can steal Telegram session data, collect messages and media, and secretly record audio from infected Windows systems. The campaign, observed in May 2026, affected private users as well as organizations in the public sector, IT, education, and large businesses. Researchers linked the activity to earlier Armored Likho operations through shared code, encryption methods, infrastructure patterns, and device-identification logic. The initial infection begins with a malicious Rust-based application built with the Tauri framework. It pretends to be a donation service connected to Russian foundations. Example Still Sync logs (Source: securelist) The application displays a login screen and asks victims for a password, likely supplied by the attackers. Once the correct password is entered, it shows a catalogue of donation items fetched from a remote server, making the app appear legitimate. While the victim browses the fake catalogue, the dropper silently decrypts and starts the next-stage payload. Likho Abuses GitHub C2 Still Sync is designed to steal Telegram Desktop session data , especially the tdata folder. This can give attackers c

3. update from gbhackers.com

   Armored Likho Turns Windows Microphones Into Automated Eavesdropping Devices

   gbhackers.com · 61d ago · August 13th, 2026

   Armored Likho, also tracked as Eagle Werewolf, has expanded its espionage capability with a Rust-based toolkit that can hijack Telegram sessions and transform compromised Windows endpoints into automated audio-surveillance devices. The newly documented May 2026 campaign primarily targets Russian private individuals, corporations, government bodies, IT organizations, and educational institutions through a fraudulent donation-service application. The […] The post Armored Likho Turns Windows Microphones Into Automated Eavesdropping Devices appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .