Armored Likho Abuses GitHub as Backup C2 Channel for Audio Surveillance Malware

Armored Likho, also known as Eagle Werewolf, has launched a new cyber-espionage campaign targeting individuals and organizations in Russia.

The group used fake donation applications as bait, but its latest malware toolkit is the bigger concern. The attackers can steal Telegram session data, collect messages and media, and secretly record audio from infected Windows systems.

The campaign, observed in May 2026, affected private users as well as organizations in the public sector, IT, education, and large businesses.

Researchers linked the activity to earlier Armored Likho operations through shared code, encryption methods, infrastructure patterns, and device-identification logic.

The initial infection begins with a malicious Rust-based application built with the Tauri framework. It pretends to be a donation service connected to Russian foundations.

The application displays a login screen and asks victims for a password, likely supplied by the attackers. Once the correct password is entered, it shows a catalogue of donation items fetched from a remote server, making the app appear legitimate.

While the victim browses the fake catalogue, the dropper silently decrypts and starts the next-stage payload. Researchers identified two main Rust-based implants in this toolkit, Still Sync and Still Audio.

Likho Abuses GitHub C2

Still Sync is designed to steal Telegram Desktop session data, especially the tdata folder. This can give attackers continued access to a victim’s Telegram account without needing the account password or receiving new login codes.

The malware first registers the infected machine with its command-and-control server.

It collects system details including the motherboard serial number, CPU ID, system UUID, BIOS serial number, and computer domain name. These values are combined, hashed with SHA-256, and used as a unique system marker.

After registration, the server sends instructions that control what the malware does. It can enable extended searches for Telegram data, collect session files, access Telegram chats, and download media.

Still Sync checks standard Telegram Desktop paths, Microsoft Store installation folders, and, in some cases, broader locations on the disk.

The implant can also try to bypass file-access restrictions. It uses backup-related techniques, including the Windows Shadow Copy service and Robocopy backup mode, to access protected files.

Once it obtains Telegram session data, it can use the Telegram API to extract account details, private chats, group and channel information, messages, contacts, documents, photos, stickers, and other media files under 250 MB.

This gives the attackers far more than a simple credential-stealing capability. It creates a path for ongoing intelligence collection from a compromised messaging account, securelist said.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR