Armored Likho Turns Windows Microphones Into Automated Eavesdropping Devices

Armored Likho, also tracked as Eagle Werewolf, has expanded its espionage capability with a Rust-based toolkit that can hijack Telegram sessions and transform compromised Windows endpoints into automated audio-surveillance devices.

The newly documented May 2026 campaign primarily targets Russian private individuals, corporations, government bodies, IT organizations, and educational institutions through a fraudulent donation-service application.

The initial lure is a Windows application built with the Tauri framework and designed to resemble a legitimate fundraising platform.

Victims are presented with a password-protected login screen and a catalog of donation items retrieved from attacker-controlled infrastructure.

While the interface provides enough interactivity to appear credible, the application silently decrypts and launches its next-stage payload in the background.

This tradecraft resembles prior Armored Likho activity involving decoy Starlink-related services, fundraising lures, and Rust-based droppers.

BI.ZONE’s earlier analysis also documented its use of system-identification collection through WMI and PowerShell commands.

The latest intrusion chain deploys the Still Toolkit, a two-component espionage suite composed of Still Sync and Still Audio.

Kaspersky Researchers said that, Eagle Werewolf activity to campaigns targeting law-enforcement personnel through malicious applications and documents, showing the group’s recurring use of socially engineered Windows payloads.

Still Sync targets Telegram Desktop session data, specifically the tdata directory that can allow an attacker to impersonate a victim’s Telegram account.

Likho Hijacks Microphones

Rather than merely stealing files for offline analysis, the malware can authenticate through the Telegram API and automatically retrieve conversations, media, contacts, group details, and channel content.

The implant compares the calculated RMS value against the vad_threshold parameter. If RMS meets or exceeds this threshold, recording starts. 

Still Sync is implemented as an asynchronous Rust application using Tokio, gRPC, and FlatBuffers. It fingerprints systems by collecting motherboard serial numbers, CPU identifiers, BIOS serial numbers, system UUIDs, and domain information.

The resulting data is concatenated and hashed with SHA-256 to create a sysmarker identifier. This implementation overlaps with the group’s previously identified AquilaRAT tooling, reinforcing attribution to Armored Likho.

The malware searches standard Telegram Desktop locations and, when instructed by its C2 server, expands its search to portable installations.

It can also exploit SeBackupPrivilege to access otherwise restricted files, including through backup-oriented file access, Volume Shadow Copy, and Robocopy backup mode.

That combination increases the likelihood of recovering Telegram session material even when normal access controls interfere.

Still Audio is the campaign’s more concerning component. The Rust implant enumerates available recording devices, registers them with its command-and-control server, and records audio when it detects speech.

It relies on a lightweight voice-activity-detection mechanism based on Root Mean Square calculations, measuring incoming signal power against a server-defined threshold.

Audio above the threshold triggers recording, while a pre-buffer preserves speech occurring immediately before detection.

Captured recordings are encoded using libmp3lame.dll and uploaded to the attacker’s server. The module can persist as a Windows service named auxhost, while one observed sample used the filename IntAudio.exe and appeared in Windows microphone-privacy settings as “Intel Audio.”

This operational mistake gives defenders a useful hunting lead, although it does not diminish the implant’s surveillance value.

Armored Likho can now combine Telegram account compromise with endpoint-level microphone surveillance, enabling operators to capture both historical communications and real-world conversations from a single infected Windows system.

Still Audio also uses a dead-drop resolver as C2 fallback infrastructure. If its primary server remains unavailable for three days, it retrieves an encrypted C2 address from a GitHub-hosted resource.

The mechanism reportedly uses Base64 encoding and Blowfish encryption in ECB mode, sharing an algorithm and key associated with older AquilaRAT samples.

The campaign demonstrates a clear evolution from credential theft toward persistent, multi-channel intelligence collection.

Kaspersky detects related activity as Trojan.Win64.Agent.* and HEUR:Backdoor.Win32.Generic.

For defenders, suspicious donation applications, unexpected microphone activity, Rust-based binaries, access to Telegram tdata, and traffic to service-themed domains warrant immediate investigation.

Indicators of compromise

Malware	File Hash (MD5)
Dropper	C1D1EE16B92E6A138FFA048855F75D7D
Dropper	17674B250D8B422A50A86C9FF207186D
Dropper	62801F6223E860A7CCA271522E303B2D
Still Sync	68F0365D2FA8C828D012D8859E52A773
Still Sync	4BD7C352AE277B0E38D07BEEDD4DD507
Still Sync	D4BC09FB10EA2A5DC0BCBEEDA5E5AFDD

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now