Loading malware…
Still Audio is a Rust-based audio surveillance implant associated with the Still Toolkit, an espionage framework attributed with high confidence to Armored Likho, also known as Eagle Werewolf. It is designed for covert microphone monitoring on Windows systems and performs voice-triggered recording rather than continuous capture, using an RMS-based voice activity detection mechanism with configurable thresholds, silence duration, buffer size, and audio-device selection. Captured audio is encoded to MP3 and uploaded to attacker-controlled infrastructure.
The implant supports covert persistence by installing itself as a background service when launched without a console argument. It registers infected hosts with its command infrastructure, transmits information about available audio input devices, and receives operational settings from the server. It also includes resilience features for command-and-control recovery, including fallback configuration sources and a dead-drop resolver mechanism that retrieves encrypted server information from a GitHub-hosted location after prolonged loss of connectivity.
Still Audio was deployed in a May 2026 cyber-espionage campaign targeting private individuals and organizations in Russia, including corporate, government, IT, and education sectors. In that campaign, initial access was achieved through a fake donation-themed application built with Rust and Tauri that acted as a dropper for the broader Still Toolkit. Code and tradecraft overlaps link the malware to earlier Armored Likho activity, including similarities with AquilaRAT in encryption and infrastructure-recovery logic. The implant’s role within the toolkit is focused on covert collection of spoken information from compromised endpoints.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Still Audio is an audio surveillance implant written in Rust. Its main job is to analyze the incoming audio stream and start recording voice when certain conditions are met.
Still Audio is an audio surveillance implant written in Rust. Its main job is to analyze the incoming audio stream and start recording voice when certain conditions are met.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
It talks to the server over gRPC... It supports both HTTP and HTTPS as transport protocols... sends it in a POST request to /still.rpc.Sync/RegisterMachine.
18 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Rust-based audio surveillance implant that captures microphone input, uses RMS-based voice activity detection to record speech, encodes recordings as MP3, and uploads them to command-and-control infrastructure.
Rust-based audio surveillance implant that monitors microphone input, detects speech using an RMS/VAD-like threshold, records conversations, encodes them with libmp3lame, and uploads recordings to C2. It also supports dead-drop resolution via GitHub to recover C2 addresses.
A Rust-based audio surveillance implant that captures microphone input, detects speech using RMS/VAD-style logic, records conversations, encodes them with libmp3lame, and uploads recordings to C2.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.