Armored Likho STILL Toolkit Steals Telegram Sessions and Records Conversations

A cyber-espionage campaign attributed to Armored Likho, also known as Eagle Werewolf, is targeting individuals and organizations in Russia with a Rust-based malware framework called the STILL Toolkit.

The campaign was identified by Securelist in May 2026. The toolkit is delivered through a convincing fake donation application and contains multiple components designed to steal Telegram sessions and monitor victims through their microphones.

Key Highlights

• Threat actor: Armored Likho / Eagle Werewolf
• Malware framework: STILL Toolkit
• Primary target: Russia
• Malware language: Rust
• Delivery lure: Fake charitable donation application
• Still Sync steals Telegram Desktop sessions and account data
• Still Audio records microphone conversations
• Telegram chats, groups, channels, contacts and media can be collected
• Audio recordings are converted to MP3 and exfiltrated
• Malware components operate as Windows services
• Multiple C2 domains and IP addresses identified
• Dead-drop resolver hosted through GitHub infrastructure

Initial Access

The exact initial delivery mechanism remains unclear, but victims are presented with an application that appears to provide a legitimate charitable donation service.

The application contains:

• A convincing login screen
• A donation or product catalog
• Password-protected functionality
• Legitimate-looking user interface elements

While the victim interacts with the fake application, the malicious components operate in the background.

Still Sync

The first major component is Still Sync.

It searches for Telegram Desktop session data stored on the infected system.

By obtaining an existing Telegram session, attackers may be able to access the victim's account without requiring the victim's normal Telegram password.

Still Sync can collect:

• Telegram account information
• Private chats
• Groups
• Channels
• Contacts
• Phone numbers
• Group membership information
• Documents
• Photos
• Stickers
• Media files smaller than 250 MB

The malware initially registers the compromised device with its command server and waits for configuration instructions before activating collection functionality.

Telegram Session Theft

The theft of local Telegram session data is particularly significant because it abuses an already authenticated session rather than attempting to steal the user's password directly.

A compromised Telegram session may provide access to private conversations, groups, channels and files.

Still Sync searches both normal and portable Telegram installation locations and can use backup-based methods when standard file access is unsuccessful.

Organizations should therefore consider Telegram session compromise separately from conventional credential theft.

Still Audio

The second component, Still Audio, extends the toolkit's surveillance capabilities by monitoring the victim's microphone.

The module waits until audio exceeds a configured threshold and then begins recording.

The recording process includes:

• Audio threshold detection
• Pre-recording buffer
• Conversation recording
• MP3 conversion
• Upload to attacker infrastructure

The module can operate as a Windows service and remain active in the background.

Microphone Surveillance

Researchers observed that Still Audio did not completely hide its microphone activity.

The malicious program appeared in Windows microphone privacy settings under a name designed to resemble a legitimate audio component.

This provides a useful detection opportunity for defenders investigating suspicious microphone access.

Unexpected microphone access by unknown services or executables should be treated as suspicious.

Persistence

The STILL Toolkit uses Windows services to maintain background execution.

Observed service names include:

TReload

and:

auxhost

Still Sync also creates a hidden error-log artifact named:

bin

while Still Audio was observed using:

IntAudio.exe

and:

libmp3lame.dll

for audio processing.

Command and Control

The malware communicates with attacker-controlled infrastructure to register compromised systems, retrieve configuration and upload stolen information.

Observed infrastructure includes:

• tg4service[.]com
• srwinservice[.]com
• screenserv[.]com
• windowserv[.]net
• managementapiservice[.]com
• service8date[.]com
• updateservs[.]com

Still Sync and Still Audio use separate infrastructure for their respective operations.

Dead-Drop Resolver

The campaign also uses a GitHub-hosted JSON file as a dead-drop resolver:

hxxps://raw.githubusercontent[.]com/mmarln/pi-mono/refs/heads/main/packages/pods/src/array12.json

The file is used to retrieve an encrypted command-server address.

Using a legitimate service such as GitHub for configuration retrieval can make infrastructure-based detection more difficult.

Infrastructure Resilience

Still Audio includes a fallback mechanism that allows operators to change the command server if the primary infrastructure becomes unavailable for three days.

This provides resilience against infrastructure takedowns and allows the campaign to continue operating after individual C2 servers are disrupted.

Detection and Hunting Opportunities

Security teams should monitor for:

• Unauthorized Telegram Desktop session files
• Unexpected access to Telegram data directories
• Suspicious Windows services named TReload or auxhost
• IntAudio.exe
• libmp3lame.dll in unusual directories
• Suspicious microphone access
• Unknown applications appearing in Windows microphone privacy settings
• Unexpected MP3 files generated by unknown processes
• Connections to known STILL Toolkit infrastructure
• Requests to suspicious GitHub raw-content URLs
• Unknown executables registering themselves as Windows services
• Large outbound transfers following Telegram data collection
• Access to Telegram databases and session files by unknown processes

Recommended Mitigations

1. Audit Telegram sessions for suspicious or unfamiliar active sessions.
2. Terminate all unauthorized Telegram sessions.
3. Remove suspicious donation or unofficial Telegram-related applications.
4. Monitor Windows service creation and modification.
5. Monitor access to Telegram Desktop data directories.
6. Monitor microphone access by unauthorized applications.
7. Detect suspicious MP3 creation and outbound transfers.
8. Block known STILL Toolkit infrastructure.
9. Monitor GitHub Raw access from suspicious processes.
10. Deploy endpoint detection capable of identifying Rust-based malware behavior.
11. Preserve forensic evidence before removing suspected malware.
12. Rotate credentials after suspected account compromise.
13. Review affected users' Telegram chats and files for potential data exposure.

Threat Assessment

The STILL Toolkit presents a significant surveillance threat because it combines Telegram session theft with microphone monitoring.

Unlike conventional infostealers that primarily collect credentials, STILL can provide attackers with continuing access to private communications and physical conversations around an infected device.

The modular architecture also allows the operators to activate different capabilities depending on the target and campaign requirements.

Indicators of Compromise

• C1D1EE16B92E6A138FFA048855F75D7D17674B250D8B422A50A86C9FF207186D — SHA-256
• 62801F6223E860A7CCA271522E303B2D68F0365D2FA8C828D012D8859E52A773 — SHA-256
• 4BD7C352AE277B0E38D07BEEDD4DD507D4BC09FB10EA2A5DC0BCBEEDA5E5AFDD — SHA-256
• 2CA8ADBAB98EBE305EACF272CF48F5A03AC41B097236A7723821848AE31EF141 — SHA-256
• 439255736797BC88BD19F282449E0436 — File Hash
• orderapiserver[.]info — 187.127.153[.]38
• tg4service[.]com — 159.198.37[.]74
• srwinservice[.]com — 213.252.244[.]123
• screenserv[.]com — 23.26.237[.]250
• windowserv[.]net — 23.27.24[.]30
• managementapiservice[.]com — 188.212.124[.]178
• service8date[.]com — 145.223.69[.]143
• updateservs[.]com — 145.223.68[.]66
• IntAudio.exe — Still Audio sample
• libmp3lame.dll — Audio library
• logfile.log — Logging artifact
• bin — Still Sync artifact
• TReload — Windows service
• auxhost — Windows service

Conclusion

Organizations should treat unauthorized Telegram applications and suspicious donation software as potential malware delivery mechanisms.

Security teams should hunt for the STILL Toolkit by monitoring Telegram session access, Windows service creation, suspicious microphone activity, MP3 generation and connections to the identified C2 infrastructure.

If compromise is suspected, affected Telegram sessions should be terminated immediately and the endpoint should undergo forensic investigation.