Kaspersky Details Armored Likho’s Telegram-Stealing and Audio-Surveillance Toolkit

Aug 13, 2026 · Original article ↗

Summary

Kaspersky reports a Russia-focused campaign it attributes with high confidence to Armored Likho. A fake donation app deploys the Rust-based Still Toolkit, which steals Telegram data and records audio when speech is detected.

Key points

The campaign targets users in Russia, primarily private individuals, as well as corporate, government, IT, and education organizations.
A Rust app built with the Tauri framework impersonates a donation service; its distribution method is unknown. After the user enters a password, the dropper launches the next-stage payload in the background.
Still Sync steals Telegram session data and can use the Telegram API to collect account details, chats, and media. Its activity depends on settings retrieved from its command-and-control server.
Still Audio uses voice-activity detection based on audio signal levels to trigger recording, then sends recordings to a command-and-control server.
If its command-and-control server is unreachable for three days, Still Audio can retrieve a fallback address from a GitHub repository; the address is Base64-encoded and Blowfish-encrypted.
Kaspersky says code, encryption, system-identification, and infrastructure similarities support its high-confidence attribution to Armored Likho. It found no direct domain or IP overlap with the February campaign.
Kaspersky products detect the threat as Trojan.Win64.Agent.* and HEUR:Backdoor.Win32.Generic.

Article Details

Attack Vectors: A fake donation-service app, written in Rust using Tauri, prompts the victim for a password and displays a donation catalog while decrypting and launching the next-stage payload.
Still Sync searches for Telegram tdata files on the victim’s device, then uses the recovered session data to access the victim’s Telegram account and collect chats, media, and account information.
Still Sync can use Windows backup mechanisms, including Shadow Copy and Robocopy in backup mode, to access files when standard access methods fail.
Still Audio monitors microphone input, records when its voice-activity threshold is met, and sends the recordings to a command-and-control server.
If its current command-and-control server remains unreachable for three days, Still Audio retrieves an updated server address from a GitHub repository.
Defensive Notes: Kaspersky products detect the threat as Trojan.Win64.Agent.* and HEUR:Backdoor.Win32.Generic.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`managementapiservice[.]com`	Domain listed as campaign infrastructure.
DOMAIN	`orderapiserver[.]info`	Campaign infrastructure used by the fake donation app to retrieve catalog data.
DOMAIN	`screenserv[.]com`	Domain listed as campaign infrastructure.
DOMAIN	`service8date[.]com`	Domain listed as campaign infrastructure.
DOMAIN	`srwinservice[.]com`	Default command-and-control domain used by Still Audio.
DOMAIN	`tg4service[.]com`	Still Sync command-and-control domain; also listed as campaign infrastructure.
DOMAIN	`updateservs[.]com`	Domain listed as campaign infrastructure.
DOMAIN	`windowserv[.]net`	Domain listed as campaign infrastructure.
IPV4	`145[.]223[.]68[.]66`	IP address listed in the campaign infrastructure table for updateservs[.]com.
IPV4	`145[.]223[.]69[.]143`	IP address listed in the campaign infrastructure table for service8date[.]com.
IPV4	`159[.]198[.]37[.]74`	IP address listed as campaign infrastructure associated with the tg4service[.]com C2 domain.
IPV4	`187[.]127[.]153[.]38`	IP address listed as campaign infrastructure associated with the orderapiserver[.]info domain.
IPV4	`188[.]212[.]124[.]178`	IP address listed in the campaign infrastructure table for managementapiservice[.]com.
IPV4	`213[.]252[.]244[.]123`	IP address listed as campaign infrastructure associated with the srwinservice[.]com C2 domain.
IPV4	`23[.]26[.]237[.]250`	IP address listed in the campaign infrastructure table for screenserv[.]com.
IPV4	`23[.]27[.]24[.]30`	IP address listed in the campaign infrastructure table for windowserv[.]net.
MD5	`17674b250d8b422a50a86c9ff207186d`	MD5 hash of a dropper sample listed in the article.
MD5	`2ca8adbab98ebe305eacf272cf48f5a0`	MD5 hash of a Still Audio sample listed in the article.
MD5	`3ac41b097236a7723821848ae31ef141`	MD5 hash of a Still Audio sample listed in the article.
MD5	`439255736797bc88bd19f282449e0436`	MD5 hash of a Still Audio sample listed in the article.
MD5	`4bd7c352ae277b0e38d07beedd4dd507`	MD5 hash of a Still Sync sample listed in the article.
MD5	`62801f6223e860a7cca271522e303b2d`	MD5 hash of a dropper sample listed in the article.
MD5	`68f0365d2fa8c828d012d8859e52a773`	MD5 hash of a Still Sync sample listed in the article.
MD5	`c1d1ee16b92e6a138ffa048855f75d7d`	MD5 hash of a dropper sample listed in the article.
MD5	`d4bc09fb10ea2a5dc0bcbeeda5e5afdd`	MD5 hash of a Still Sync sample listed in the article.
URL	`hxxps[:]//raw[.]githubusercontent[.]com/mmarln/pi-mono/refs/heads/main/packages/pods/src/array12.json`	Specific GitHub-hosted dead-drop resolver resource from which Still Audio retrieves the current C2 address.