Armored Likho expands its cyber-espionage toolkit

The Armored Likho group (also known as Eagle Werewolf) has significantly expanded its cyber-espionage toolkit with the introduction of the ‘Still Toolkit,’ a new set of tools designed for advanced surveillance and data theft. The toolkit includes Still Sync, a Stealer for Telegram session data, and Still Audio, an audio surveillance implant. Still Sync steals Telegram data, including user details, chat logs, media files, and contacts, while Still Audio records audio conversations based on voice activity detection. The group has been active since November 2024, with overlaps with previous campaigns in February and July 2026, utilizing similar techniques like fundraising lures and leveraging a common hashing algorithm. The toolkit’s development demonstrates a clear escalation in Armored Likho’s capabilities and targeting of private individuals and organizations in Russia, including major corporations and the public sector.