Armored Likho Expands Its Cyber-Espionage Arsenal with the S...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://securelist.com/armored-likho-still-toolkit/121033
• Blog Title: Armored Likho Expands Its Cyber-Espionage Arsenal with the Still Toolkit
• Suggested Section: Windows Hardening > Stealing Windows Credentials / Windows Local Privilege Escalation (SeBackupPrivilege abuse), with supporting material under Basic Forensic Methodology > Malware Analysis for dead-drop C2 and voice-triggered surveillance

🎯 Content Summary

Campaign overview and impact

In May 2026, Kaspersky discovered a cyber-espionage campaign attributed with high confidence to Armored Likho, also known as Eagle Werewolf. The campaign primarily targeted private individuals in Russia, but also affected major corporations, public-sector organizations, IT companies, and educational institutions. It used a fake donation application to deploy the Rust-based Still Toolkit, consisting of 🔧 Technical Details

Functional GUI lure hiding background payload execution: A malicious Rust/Tauri application can present a password-protected interface and retrieve legitimate-looking catalog content from remote API endpoints while silently decrypting and executing another payload. The functional UI distracts the victim and makes the application appear authentic. Detection opportunities include Tauri executables containing encrypted multipart payloads, markers such as ICRYPTMP, unrelated network requests, and background process or service creation while the user interacts with the GUI.

Telegram Desktop session theft and reuse: Malware can locate and steal Telegram Desktop's tdata from standard installations, Microsoft Store package directories, portable installations, or an operator-supplied path. A separate passcode may be provided when local data encryption is enabled. Reusing valid session material through the Telegram API can...

🤖 Agent Actions

Plan:

1. Map relevant Windows credential, backup-privilege, malware-analysis, C2, and audio-surveillance pages.
2. Read at least five candidate pages and compare existing coverage to avoid duplication.
3. Add only the novel techniques to the single best existing page, with numbered citations and references.
4. Re-read the edited file, inspect the diff, and run focused validation.
   Repository review is complete: the strongest fit is the existing Stealing Windows Credentials page. The local privilege pages already cover generic SeBackupPrivilege, VSS, and robocopy /B; the missing value is the application-session workflow—discovering Telegram Desktop tdata, acquiring locked files with backup-aware fallbacks, then reusing the session. I’ll keep the addition focused there rather than duplicating generic malware tradecraft elsewhere.
   The credential-theft addition is now in place with official Microsoft and Telegram references. A final gap check shows two separate analysis primitives from the post are not documented anywhere else: decoding a public-repository dead drop and recognizing RMS/pre-buffer voice activation. I’ll add those as a distinct malware-analysis subsection (without repeating the credential material), then validate both files.
   Implementation is complete. The public dead-drop technique was intentionally not duplicated because three existing privacy/attribution pages already document it, including sequence-based detection. I’m now checking reference integrity, forbidden-source absence, Markdown structure, and the final diff.
   Updated two existing HackTricks pages:

• src/windows-hardening/stealing-credentials/README.md

  • Telegram Desktop tdata discovery and session reuse
  • SeBackupPrivilege, VSS, and robocopy /B acquisition fallbacks
  • Snapshot-based exfiltration deduplication
  • Detection and session-revocation guidance

• src/generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.md

  • RMS-based voice-triggered recording
  • Pre-buffer and silence-threshold logic
  • Dynamic-analysis and endpoint-hunting techniques

Added numbered citations to Kaspersky, Microsoft, and Telegram sources. Dead-drop resolver material was not duplicated because it is already documented elsewhere in the repository.

Validation:

• git diff --check: passed
• Reference and citation integrity: passed
• Forbidden-source check: passed
• Full mdBook build skipped because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://securelist.com/armored-likho-still-toolkit/121033

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening > Stealing Windows Credentials / Windows Local Privilege Escalation (SeBackupPrivilege abuse), with supporting material under Basic Forensic Methodology > Malware Analysis for dead-drop C2 and voice-triggered surveillance".

Repository Maintenance:

• MD Files Formatting: 1029 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0