Executive Summary
In May 2026, a new cyber-espionage campaign attributed to the Armored Likho group (also known as Eagle Werewolf) was discovered targeting private individuals and organizations across Russia, specifically in the government, IT, and education sectors. The group utilizes a dropper disguised as a donation application, built on the Tauri framework, to deliver a newly identified Rust-based modular suite known as the 'Still Toolkit'.
The toolkit consists of two primary components: Still Sync, designed to exfiltrate Telegram session data (tdata) and monitor communications, and Still Audio, a sophisticated eavesdropping implant that uses Voice Activity Detection (VAD) to record conversations. The campaign demonstrates an evolution in the group's tradecraft, utilizing gRPC for command-and-control (C2) and Dead Drop Resolvers on GitHub to maintain infrastructure resilience. The high degree of code reuse from previous AquilaRAT campaigns confirms the continued activity of this persistent threat actor.
This expansion of capabilities indicates a strategic shift toward controlling multiple communication channels, including messaging apps and real-world audio environments. Organizations in the targeted sectors should prioritize monitoring for the specific persistence mechanisms and network traffic patterns associated with this modular toolkit.