Loading story…
Armored Likho, also tracked as Eagle Werewolf, launched a cyber-espionage campaign against private users and organizations in Russia, including targets in government, corporate, IT, and education sectors. The operation used fake charity-assistance applications built as Rust/Tauri droppers to install a new modular espionage framework called Still Toolkit. Its Still Sync component steals Telegram Desktop session data, authenticates to victims’ Telegram accounts, and exfiltrates chats, media, and account details through the Telegram API, while Still Audio covertly activates microphone surveillance by detecting speech and uploading recordings to command-and-control servers.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
The May 2026 Armored Likho campaign introduced a new Rust-based espionage suite called Still Toolkit, consisting of Still Sync and Still Audio. Still Sync stole Telegram Desktop session data and exfiltrated chats and media via the Telegram API, while Still Audio covertly recorded microphone audio when speech was detected.
In May 2026, a new cyber-espionage campaign attributed with high confidence to Armored Likho targeted private users and organizations in Russia, including corporate, government, IT, and education sectors. The attackers used fake charity-assistance applications themed around several foundations as the initial lure.
In February 2026, Eagle Werewolf used a compromised UAV-themed Telegram channel and support account to distribute a ZIP archive containing a Rust/Tauri dropper disguised as part of a fake Starlink activation process. The dropper decrypted and launched a Go payload and registered infected machines with command-and-control infrastructure.
Researchers identified Eagle Werewolf as a distinct cluster after linking espionage activity detected in February 2026 to earlier campaigns. Positive Technologies and BI.ZONE described this as the basis for separating the cluster from related 'werewolf' activity.
BI.ZONE reported that the Eagle Werewolf cluster had been active since at least May 2023. The group was assessed to target government and industrial organizations as well as people connected to UAV production and engineering.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 62 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
8 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourcesecurelist.ru
Open sourcesecurelist.com
Open sourcebi.zone
Open sourcebi.zone
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Armored Likho** (also tracked as **Eagle Werewolf**) is running a spear-phishing campaign against government agencies and electrical power organizations in **Russia, Brazil, and Kazakhstan**, using lures themed as official notices, humanitarian aid requests, and social programs. Victims are enticed into opening malicious archives or `.lnk` files, including files that abuse `ZDI-CAN-25373`, which launch staged loaders, decoy documents, and PowerShell activity before downloading Python components from GitHub such as **Python 3.12**, `get-pip.py`, and the main payload `module.pyw` to install the **BusySnake Stealer**. BusySnake is a Python-based, heavily obfuscated infostealer protected with **PyArmor Pro 9.2.0** that steals browser credentials and cookies, screenshots, clipboard data, documents, Telegram session files, 2FA-related data, and cryptocurrency wallet information. Researchers said newer variants delay execution for anti-analysis, change persistence through scheduled tasks and Windows component interfaces, add a task-status command-and-control framework, and support in-memory execution of arbitrary Python scripts, while the broader toolset can also deploy **RustDesk** and use reverse SSH tunneling for remote access. Attribution to Armored Likho was made with medium confidence based on overlaps with earlier tools including **Go2Tunnel** and **AquilaRAT**, and some first-stage loaders showed signs of possible AI-assisted generation.
Jul 13, 2026
Researchers reported that Telegram has become a major channel for **infostealer** operators to exfiltrate stolen data and distribute victim logs, exposing a large volume of corporate credentials and access data. BitSight said analysis of roughly 1,800 Telegram bots collected from October 2024 onward uncovered about **5 million logs**, **2.8 million credentials**, more than **400,000 unique domains**, and over **10,000 unique IP addresses**, with credentials linked to nearly **60,000 organizations**. The activity reflects a broader Russian-speaking infostealer ecosystem in which harvested logs are packaged, shared, and monetized for follow-on intrusion activity. The most prominent malware families observed were **SnakeKeylogger** and **AgentTesla**, with SnakeKeylogger rising sharply and **VipKeylogger** appearing as a SnakeKeylogger variant, while AgentTesla/OriginLogger activity declined after operators reportedly lost access to servers and backups. Infections were globally distributed, led by the **United States, Turkey, and Russia**, followed by **India and Germany**. The findings underscore that stolen credentials remain a key initial-access vector, prompting recommendations to block `api.telegram.org` where not required, enforce **MFA**, and monitor for leaked credentials tied to enterprise accounts.
Aug 15, 2026
Armored Likho, a previously undocumented APT group also linked by indirect indicators to **Eagle Werewolf**, has been running a spear-phishing campaign against government agencies and electric power organizations in **Russia, Kazakhstan, and Brazil**. The attackers deliver a newly identified Python-based infostealer, **BusySnake Stealer**, through archive attachments containing either NSIS-built executable droppers or malicious `.lnk` files, including samples that abuse `ZDI-CAN-25373` to conceal command-line arguments. Researchers said the malware is heavily obfuscated with **PyArmor** and that some first-stage loaders appear to be AI-generated, complicating attribution while preserving the group’s broader tradecraft. Once installed, BusySnake establishes persistence with **VBScript** and scheduled tasks, then steals browser passwords, cookies, clipboard contents, screenshots, documents, Telegram session data, OTP secrets, and cryptocurrency wallet files. The malware also supports reverse SSH tunneling and remote control, downloads Python runtimes and dependencies, and in newer variants fetches and executes Python payloads directly in memory while tracking task status through an updated C2 framework. Reported infrastructure includes `159.198.41[.]140` and `grked[.]online`, and researchers noted architectural overlap with **AquilaRAT** and functional similarities to **Go2Tunnel**, reinforcing the attribution to Armored Likho.
Jul 12, 2026