Armored Likho expanded its cyber-espionage toolkit with a new Rust-based framework called Still Toolkit, comprising Still Sync and Still Audio. Still Sync steals Telegram session data from the tdata folder, authenticates to the victim's Telegram account via the Telegram API, and exfiltrates messages, media, and channel data. Still Audio captures audio from input devices using a custom RMS-based Voice Activity Detection algorithm, encodes recordings with libmp3lame, and sends them to a C2 server. Both modules communicate over gRPC with FlatBuffers serialization, create Windows services for persistence, and share code-level overlap with earlier AquilaRAT samples including the same sysmarker hashing algorithm and Blowfish-ECB dead drop resolver key.
Rust malware
2 posts
Armored Likho expands its cyber-espionage toolkit Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel Cisco Talos has identified msaRAT, a new Rust-based remote access trojan attributed to the Chaos ransomware group, which establishes a covert C2 channel by hijacking the victim's browser via Chrome DevTools Protocol (CDP). The RAT launches Chrome or Edge in headless mode, injects JavaScript to create a WebRTC DataChannel using Cloudflare Workers for signaling and Twilio TURN as a relay, ensuring all network traffic originates from the browser process and blends with legitimate web traffic. The malware employs double-layer encryption (DTLS plus ChaCha-Poly1305 with ECDH key exchange) and routes all C2 through legitimate cloud infrastructure, making detection and tracing exceptionally difficult.
