13 minhigh
Armored Likho expands its cyber-espionage toolkit
Armored Likho expanded its cyber-espionage toolkit with a new Rust-based framework called Still Toolkit, comprising Still Sync and Still Audio. Still Sync steals Telegram session data from the tdata folder, authenticates to the victim's Telegram account via the Telegram API, and exfiltrates messages, media, and channel data. Still Audio captures audio from input devices using a custom RMS-based Voice Activity Detection algorithm, encodes recordings with libmp3lame, and sends them to a C2 server. Both modules communicate over gRPC with FlatBuffers serialization, create Windows services for persistence, and share code-level overlap with earlier AquilaRAT samples including the same sysmarker hashing algorithm and Blowfish-ECB dead drop resolver key.
Sens:▲ 24h
Showing defanged values
- domainmanagementapiservice[.]comC2 infrastructure domain mimicking management API services
- domainorderapiserver[.]infoAPI server used by the dropper to fetch catalog and product data to make the fake donation app appear legitimate
- domainscreenserv[.]comC2 infrastructure domain mimicking Windows system services
- domainservice8date[.]comC2 infrastructure domain mimicking Windows update mechanisms
- domainsrwinservice[.]comDefault C2 server for Still Audio module, contacted for audio machine registration and recording uploads
- domaintg4service[.]comDefault C2 server for Still Sync module, contacted over HTTPS on port 443 for machine registration and Telegram data exfiltration
- domainupdateservs[.]comC2 infrastructure domain mimicking Windows update mechanisms
- domainwindowserv[.]netC2 infrastructure domain mimicking Windows system services
- filenameC:\Users\<username>\AppData\Local\Packages\<package_folder>\LocalCache\Roaming\Microsoft Store Telegram installation directory searched by Still Sync; package folder identified by name containing 'TelegramMessenge'
- filenameC:\Users\<username>\AppData\Roaming\TelegramDesktop\Standard Telegram Desktop tdata directory searched by Still Sync for session data theft
- filenameIntAudio.exeStill Audio module dropped to disk; appears in Windows microphone settings as 'Intel Audio' to masquerade as legitimate software
- ip145[.]223[.]68[.]66IP for updateservs.com, C2 infrastructure domain
- ip145[.]223[.]69[.]143IP for service8date.com, C2 infrastructure domain
- ip159[.]198[.]37[.]74IP address resolving to tg4service.com, the Still Sync default C2 server
- ip187[.]127[.]153[.]38IP for orderapiserver.info, dropper API server for donation catalog data
- ip188[.]212[.]124[.]178IP for managementapiservice.com, C2 infrastructure domain
- ip213[.]252[.]244[.]123IP address resolving to srwinservice.com, the Still Audio default C2 server
- ip23[.]26[.]237[.]250IP for screenserv.com, C2 infrastructure domain
- ip23[.]27[.]24[.]30IP for windowserv.net, C2 infrastructure domain
- md517674b250d8b422a50a86c9ff207186dDropper sample built with Tauri framework
- md52ca8adbab98ebe305eacf272cf48f5a0Still Audio implant sample that performs covert audio surveillance with voice activity detection
- md53ac41b097236a7723821848ae31ef141Still Audio implant sample
- md5439255736797bc88bd19f282449e0436Still Audio implant sample
- md54bd7c352ae277b0e38d07beedd4dd507Still Sync implant sample
- md562801f6223e860a7cca271522e303b2dDropper sample built with Tauri framework
- md568f0365d2fa8c828d012d8859e52a773Still Sync implant sample that steals Telegram session data and exfiltrates messages and media
- md5c1d1ee16b92e6a138ffa048855f75d7dDropper sample built with Tauri framework that mimics a donation service app and decrypts Still Toolkit payloads
- md5d4bc09fb10ea2a5dc0bcbeeda5e5afddStill Sync implant sample
- urlhxxps://raw[.]githubusercontent[.]com/mmarln/pi-mono/refs/heads/main/packages/pods/src/array12[.]jsonGitHub dead drop resolver URL used by Still Audio as fallback C2 address retrieval when primary server is unreachable for three days; contains Blowfish-ECB encrypted C2 URL
Detection / Hunteropenrouter
What Happened
A hacking group called Armored Likho has been targeting people and organizations in Russia with a fake donation app that secretly installs spyware. The spyware has two new tools: one steals Telegram account data so the attackers can read the victim's messages and download their media files, and the other secretly records conversations by listening through the computer's microphone and automatically detecting when someone is speaking. The attackers disguise the recording tool as Intel Audio so it looks legitimate in Windows settings. The tools are written in the Rust programming language and communicate with attacker-controlled servers using encrypted channels. If the main servers go down, the recording tool can find new server addresses hidden in a GitHub repository. Organizations should check for the indicators listed in this report, review which apps are using microphones on their systems, and verify that Telegram sessions have not been cloned.
Key Takeaways
- Armored Likho deployed a new Rust-based espionage toolkit called Still Toolkit with two components: Still Sync (Telegram session stealer and data exfiltrator) and Still Audio (covert audio surveillance implant).
- Still Sync steals Telegram tdata folders and can authenticate to the victim's Telegram account via the Telegram API to extract messages, media files, and channel data.
- Still Audio implements a Voice Activity Detection algorithm using RMS to automatically record conversations and exfiltrate MP3-encoded audio to a C2 server.
- Both modules use gRPC with FlatBuffers serialization over HTTP/HTTPS for C2 communication and share infrastructure patterns with earlier Armored Likho campaigns including AquilaRAT.
- Still Audio uses a GitHub repository as a dead drop resolver with Blowfish-ECB encryption, falling back to this mechanism if the primary C2 is unreachable for three days.
Affected Systems
- Windows systems running Telegram Desktop or Telegram from Microsoft Store
- Users and organizations in Russia across private, corporate, government, IT, and education sectors
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Victim obtains a fake donation service app built with Tauri framework; distribution method unknown but app mimics Russian fundraising foundations
- Execution: After user enters a password in the app login form, the dropper decrypts and launches the Still Toolkit payload in the background while displaying a clickable item catalog
- Persistence: Still Sync creates a Windows service named TReload and Still Audio creates a service named auxhost to maintain background execution when --console argument is absent
- Discovery and Collection: Still Sync collects hardware identifiers (motherboard serial, CPU ID, system UUID, BIOS serial, domain name), hashes them with SHA-256 as sysmarker, and searches for Telegram tdata folders including extended C: drive search
- C2 Communication: Both modules register with their C2 servers via gRPC endpoints (RegisterMachine, RegisterAudioMachine) and retrieve configuration settings controlling malicious behavior
- Exfiltration: Still Sync steals Telegram session data and authenticates to the victim's Telegram account to extract messages, media, and channel data; Still Audio records conversations using RMS-based voice activity detection and uploads MP3-encoded audio to C2
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Kaspersky product detections (Trojan.Win64.Agent.*, HEUR:Backdoor.Win32.Generic), Kaspersky Threat Intelligence Reporting (subscription required for full IOC set)
The article provides Kaspersky product detection names and a subset of file hashes and domains as IOCs. Full IOC data is available through Kaspersky Threat Intelligence Reporting subscription. No YARA, Sigma, Snort, Suricata, KQL, SPL, or EQL rules are provided in the article.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can observe service creation (TReload, auxhost), process execution of the dropper and implants, file writes (libmp3lame.dll, logfile.log), and network connections to C2 domains. However, the use of legitimate Windows APIs and gRPC over HTTPS may blend with normal traffic. |
| Network Visibility | Medium | C2 communication uses gRPC over HTTP/HTTPS with FlatBuffers serialization. Network sensors can detect connections to the listed domains and IPs. The gRPC endpoints (/still.rpc.Sync/RegisterMachine, /still.rpc.Audio/RegisterAudioMachine, /tgfrg) are distinctive but require TLS inspection or DNS logging to observe. |
| Detection Difficulty | Moderate | The malware uses legitimate frameworks (Tauri, Tokio) and protocols (gRPC, HTTPS). Service names TReload and auxhost are distinctive. The gRPC endpoint paths are unusual. The GitHub dead drop resolver URL is a strong indicator. File hashes and domains are provided for blocking. The main challenge is that C2 traffic uses standard HTTPS on port 443. |
Required Log Sources
- Windows System event logs (service creation - Event ID 7045)
- Windows Security logs (process creation - Event ID 4688)
- DNS resolution logs
- Proxy or web gateway logs
- EDR process telemetry and file write events
- Windows microphone access audit logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for Windows services created with the names TReload or auxhost, which are used by Still Sync and Still Audio respectively for persistence. | Windows System event logs (Event ID 7045 - service installed), EDR service creation events | Persistence | Low - these service names are not associated with legitimate Windows services or common software |
| Consider hunting for processes making HTTPS connections to gRPC endpoints with paths containing /still.rpc.Sync/ or /still.rpc.Audio/ if TLS inspection is available. | Proxy logs, TLS inspection logs, network flow data with URL paths | Command and Control | Low - these endpoint paths are specific to the Still Toolkit and unlikely to appear in legitimate gRPC traffic |
| Consider hunting for processes accessing raw.githubusercontent.com followed by establishing new outbound HTTPS connections, which may indicate a dead drop resolver fallback mechanism. | DNS logs, proxy logs, EDR network connection telemetry | Command and Control | Medium - developers and CI/CD pipelines commonly access raw.githubusercontent.com; correlate with subsequent new outbound connections to unfamiliar domains |
| Consider hunting for processes named IntAudio.exe or similar that appear in Windows microphone access lists, particularly those masquerading as Intel Audio. | Windows Privacy settings microphone access logs, EDR process telemetry with microphone access monitoring | Collection | Low - legitimate Intel audio drivers do not typically appear as separate executable entries named IntAudio.exe in microphone access settings |
| Consider hunting for processes that enumerate hardware identifiers via PowerShell commands and compute a SHA-256 hash stored as sysmarker, indicating Still Toolkit or AquilaRAT registration activity. | EDR process telemetry, PowerShell script block logs (Event ID 4104), command-line auditing | Discovery | Medium - hardware inventory scripts may collect similar information; focus on processes that subsequently hash the combined string and transmit it to external servers |
Control Gaps
- Standard file access controls may not prevent tdata theft when the malware abuses SeBackupPrivilege via CreateFileW with FILE_FLAG_BACKUP_SEMANTICS, Shadow Copy, or Robocopy backup mode
- Network security controls without TLS inspection will not observe the distinctive gRPC endpoint paths used for C2 registration and data exfiltration
- The malware's use of GitHub as a dead drop resolver may bypass domain blocklists since raw.githubusercontent.com is a legitimate and widely-used domain
- Still Audio does not hide its microphone usage, but organizations without microphone access monitoring or alerting would not detect the surveillance activity
Key Behavioral Indicators
- Windows service creation with names TReload or auxhost
- Process named IntAudio.exe appearing in Windows microphone access settings as 'Intel Audio'
- Environment variables STILL_SYNC_ADDR, STILL_AUDIO_SYNC_ADDR, STILL_SEND_PATH, or STILL_TELEGRAM_PASSCODE set on a process
- gRPC POST requests to paths containing /still.rpc.Sync/ or /still.rpc.Audio/
- Process writing libmp3lame.dll to disk from within its own executable
- Hidden file named 'bin' created in the same directory as the main executable when --firefly argument is used
- Robocopy executed with /b (backup mode) flag targeting Telegram Desktop data directories
- Process accessing raw.githubusercontent.com/mmarln/pi-mono/ path followed by new outbound HTTPS connections
False Positive Assessment
Low - The service names TReload and auxhost, the gRPC endpoint paths, the GitHub dead drop resolver URL, and the IntAudio.exe filename are specific to this toolkit. The C2 domains follow naming patterns mimicking Windows services but are not registered to legitimate Microsoft infrastructure. File hashes provide additional low-FP indicators.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking the listed C2 domains and IPs at your web gateway, firewall, or DNS filtering layer.
- Consider hunting for the service names TReload and auxhost across Windows endpoints to identify potential infections.
- If your EDR supports it, consider searching for processes with environment variables STILL_SYNC_ADDR, STILL_AUDIO_SYNC_ADDR, STILL_SEND_PATH, or STILL_TELEGRAM_PASSCODE set.
- Consider reviewing Telegram Desktop sessions on systems that match the victim profile for unauthorized active sessions, and terminating any suspicious sessions.
Infrastructure Hardening
- Evaluate whether your web gateway or proxy can block or alert on connections to raw.githubusercontent.com/mmarln/pi-mono/ specifically, while allowing legitimate GitHub access.
- Consider implementing TLS inspection for outbound HTTPS traffic if not already deployed, to enable detection of the distinctive gRPC endpoint paths used by this toolkit.
- If applicable to your environment, consider restricting SeBackupPrivilege to reduce the risk of file access bypass via Shadow Copy or Robocopy backup mode.
User Protection
- Consider deploying the provided file hashes to your endpoint detection or blocklist if your EDR supports custom hash-based blocking.
- If your organization uses Telegram Desktop, consider enabling Telegram's local data encryption and evaluate whether tdata folder access monitoring is feasible.
- Consider auditing which applications have microphone access enabled on Windows endpoints and reviewing any entries masquerading as Intel Audio or named IntAudio.exe.
Security Awareness
- Consider incorporating guidance into existing awareness programs about downloading apps only from official sources, particularly regarding donation or fundraising applications.
- If applicable to your workforce, consider advising users to verify the legitimacy of donation service apps before entering passwords or credentials.
- Consider reminding users that Telegram session data stored on disk can be stolen and used to access their accounts remotely, and to review active sessions periodically.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping14 techniques
Tactic
Persistence
Tactic
Stealth
Tactic
Credential Access
Tactic
Discovery
Tactic
Collection
Tactic
Command and Control
Additional IOCs
- Ips:
187[.]127[.]153[.]38- IP for orderapiserver.info, dropper API server for donation catalog data23[.]26[.]237[.]250- IP for screenserv.com, C2 infrastructure domain23[.]27[.]24[.]30- IP for windowserv.net, C2 infrastructure domain188[.]212[.]124[.]178- IP for managementapiservice.com, C2 infrastructure domain145[.]223[.]69[.]143- IP for service8date.com, C2 infrastructure domain145[.]223[.]68[.]66- IP for updateservs.com, C2 infrastructure domain
- Domains:
screenserv[.]com- C2 infrastructure domain mimicking Windows system serviceswindowserv[.]net- C2 infrastructure domain mimicking Windows system servicesmanagementapiservice[.]com- C2 infrastructure domain mimicking management API servicesservice8date[.]com- C2 infrastructure domain mimicking Windows update mechanismsupdateservs[.]com- C2 infrastructure domain mimicking Windows update mechanisms
- File Hashes:
17674B250D8B422A50A86C9FF207186D(MD5) - Dropper sample built with Tauri framework62801F6223E860A7CCA271522E303B2D(MD5) - Dropper sample built with Tauri framework4BD7C352AE277B0E38D07BEEDD4DD507(MD5) - Still Sync implant sampleD4BC09FB10EA2A5DC0BCBEEDA5E5AFDD(MD5) - Still Sync implant sample3AC41B097236A7723821848AE31EF141(MD5) - Still Audio implant sample439255736797BC88BD19F282449E0436(MD5) - Still Audio implant sample
- File Paths:
C:\Users\<username>\AppData\Roaming\Telegram Desktop\- Standard Telegram Desktop tdata directory searched by Still Sync for session data theftC:\Users\<username>\AppData\Local\Packages\<package_folder>\LocalCache\Roaming\- Microsoft Store Telegram installation directory searched by Still Sync; package folder identified by name containing 'TelegramMessenge'
- Command Lines:
- Purpose: Running Still Sync implant in console mode with debug logging enabled | Tools:
winapi.exe| Stage: Execution |winapi.exe --db --console - Purpose: Copying Telegram tdata files using backup mode as fallback when standard file access fails | Tools:
robocopy| Stage: Collection |robocopy <source> <dest> /b
- Purpose: Running Still Sync implant in console mode with debug logging enabled | Tools:
- Other:
5c8e153228edd3c6cbf75684- Blowfish-ECB encryption key used by Still Audio dead drop resolver to decrypt C2 address from GitHub repository; identical to key used in older AquilaRAT samplesTReload- Windows service name created by Still Sync for background persistence when --console argument is absentauxhost- Windows service name created by Still Audio for background persistence when --console argument is absentSTILL_SYNC_ADDR- Environment variable used by Still Sync to specify C2 server address; default value is https://tg4service.com:443STILL_AUDIO_SYNC_ADDR- Environment variable used by Still Audio to specify C2 server address; falls back to STILL_SYNC_ADDR then to https://srwinservice.comSTILL_SEND_PATH- Environment variable used by Still Sync to specify path to Telegram tdata folderSTILL_TELEGRAM_PASSCODE- Environment variable used by Still Sync for decrypting tdata folder if Telegram data encryption is enabled on victim devicelibmp3lame.dll- MP3 encoding library extracted by Still Audio from within its executable to encode recorded audio before exfiltrationlogfile.log- Log file created by Still Audio during background operationbin- Hidden file written by Still Sync --firefly trace thread containing error messages in same folder as main executable