audio-surveillance

Armored Likho expanded its cyber-espionage toolkit with a new Rust-based framework called Still Toolkit, comprising Still Sync and Still Audio. Still Sync steals Telegram session data from the tdata folder, authenticates to the victim's Telegram account via the Telegram API, and exfiltrates messages, media, and channel data. Still Audio captures audio from input devices using a custom RMS-based Voice Activity Detection algorithm, encodes recordings with libmp3lame, and sends them to a C2 server. Both modules communicate over gRPC with FlatBuffers serialization, create Windows services for persistence, and share code-level overlap with earlier AquilaRAT samples including the same sysmarker hashing algorithm and Blowfish-ECB dead drop resolver key.