Loading malware…
AquilaRAT is a Rust-based remote access Trojan associated with the Armored Likho threat actor, also referred to as Eagle Werewolf. It has been used in espionage-oriented campaigns targeting government, industrial, and drone-related victims, including operations distributed through compromised Telegram channels and themed lures related to Starlink registration and UAV activity. The malware has been deployed through multi-stage infection chains involving Rust and Go droppers and installed for persistence as a Windows service masquerading as legitimate software.
AquilaRAT follows a task-driven architecture in which an infected host registers with command-and-control infrastructure, polls for instructions at short intervals, and executes functionality through dedicated handlers. Reported capabilities include remote command execution, file upload, and file scanning or enumeration. The malware also generates a machine identifier from host hardware and system attributes, a design element later observed in other Armored Likho tooling. Its persistence and command structure show architectural similarities to BusySnake Stealer, and its cryptographic routines and configuration handling have been reused in later malware attributed to the same actor.
The malware is notable as part of a broader in-house ecosystem developed by Armored Likho for long-term access and intelligence collection. Shared encryption methods, host-identification logic, persistence patterns, and command-and-control design link AquilaRAT to subsequent Rust-based implants and espionage tooling used by the group.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Для шифрования этой конфигурации применяется тот же алгоритм и ключ, которые ранее встречались в AquilaRAT из арсенала Armored Likho.
Worth noting: other Armored Likho tools, AquilaRAT included, use this same hashing algorithm... Older AquilaRAT samples use this exact same algorithm and key.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
A separate espionage campaign linked to the Eagle Werewolf cluster used Iraqi hosting on Regxa infrastructure to deploy multiple remote access tools via phishing lures based on Starlink registration and drone training themes.
The starting point of the attack chain is a spear-phishing email that uses lures related to official government notices or social programs to distribute a RAR archive containing EXE binaries that serve as droppers for additional payloads retrieved from a GitHub repository, including the stealer payload.
used Iraqi hosting on Regxa infrastructure to deploy multiple remote access tools via phishing lures based on Starlink registration and drone training themes.
Notably, in February 2026, it compromised one of the drone-focused Telegram channels to distribute malware.
Второй скрипт, run.vbs, предназначен для запуска module.pyw и используется для обеспечения закрепления в системе при помощи запланированной задачи... Эта задача обеспечивает запуск полезной нагрузки — BusySnake Stealer — каждые пять минут.
Il est persisté via une tâche planifiée (toutes les 5 minutes) ... Une version plus récente a été identifiée, intégrant : Création de tâches planifiées via COM object ( Schedule.Service ) au lieu de schtasks
researchers linked it to earlier activity involving AquilaRAT... Both use comparable C2 endpoints to report task execution
The algorithms match down to the PowerShell commands used to collect system information.
Cmd, performs the following actions: cmd /K chcp 65001 —sets the encoding chcp-65001, and then executes powershell <command>.
Upon execution, StarDebug_1.0.1.msi creates the directory %LOCALAPPDATA%\Star and extracts the following three files to it...
The URL hxxps://battleflight[.]org/download/installer hosted the executable BattleFlight-Install-v11.0.3.exe, a C# dropper disguised as an installer for a drone pilot training simulator.
Второй скрипт, run.vbs, предназначен для запуска module.pyw и используется для обеспечения закрепления в системе при помощи запланированной задачи... Эта задача обеспечивает запуск полезной нагрузки — BusySnake Stealer — каждые пять минут.
Il est persisté via une tâche planifiée (toutes les 5 minutes) ... Une version plus récente a été identifiée, intégrant : Création de tâches planifiées via COM object ( Schedule.Service ) au lieu de schtasks
inst_u.ps1 ... проверяет существование УЗ $sshUserName и при необходимости создает ее... Далее выполняется попытка добавления новой УЗ во встроенную группу «Администраторы».
sc create "MicrosoftOfficeUpdate" binPath = "C:\Program Files\Microsoft Office Update\MicrosoftOfficeUpdate\MicrosoftOfficeUpdate.exe" ... sc start "MicrosoftOfficeUpdate"
Второй скрипт, run.vbs, предназначен для запуска module.pyw и используется для обеспечения закрепления в системе при помощи запланированной задачи... Эта задача обеспечивает запуск полезной нагрузки — BusySnake Stealer — каждые пять минут.
Il est persisté via une tâche planifiée (toutes les 5 minutes) ... Une version plus récente a été identifiée, intégrant : Création de tâches planifiées via COM object ( Schedule.Service ) au lieu de schtasks
sc create "MicrosoftOfficeUpdate" binPath = "C:\Program Files\Microsoft Office Update\MicrosoftOfficeUpdate\MicrosoftOfficeUpdate.exe" ... sc start "MicrosoftOfficeUpdate"
Armored Likho utilizes a modular and evolving toolkit that includes obfuscated remote access trojans (RATs)...
The dropper contains the EchoGather payload, which is Base64-encoded and XOR-encrypted.
BattleFlight-Install-v11.0.3.exe, a C# dropper disguised as an installer for a drone pilot training simulator.
At the final stage of execution, the Rust dropper deletes the insider-[a-zA-Z0-9]{6} directory.
the C# dropper contains the EchoGather payload, which is Base64-encoded and XOR-encrypted.
скрипт добавляет настройку в реестре для сокрытия новой УЗ с экрана входа... UserList ... -Name $sshUserName -Value 0
To do this, Sync collects the following information about the victim’s system: Motherboard serial number CPU ID System UUID BIOS serial number Computer domain name.
ScanFiles ... The following fields are sent to the endpoint /clients/files: fileName relativePath fullPath fileSize createdDate modifiedDate
Files, uploads a directory/file from the host to the C2 server.
The updater.exe executable is a Go dropper that unpacks embedded gzip archives and launches final stage loaders.
Its primary goal is to establish communication with a C2 server and then await incoming instructions.
Обновленные конечные точки ... /api/v1/client/{Config.CLIENT_ID}/commands/ ... /tasks/ ... /files/
Also put to use in the attacks is Go2Tunnel to establish a reverse SSH tunnel to a command-and-control (C2) server using a private key.
Still Audio also uses the Dead Drop Resolver technique as a fallback mechanism for obtaining the C2 address... the tool tries to pull the current C2 URL from a GitHub repository.
The loader then fetches the Node.js interpreter (if it is not present in the system) and the next stage obfuscated JS script.
documents exfiltration... and pull out targeted files after infection
41 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.