Full Report
Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.
Analysis Summary
# Threat Actor: Armored Likho
## Attribution & Identity
* **Name:** Armored Likho
* **Aliases:** None explicitly stated, but the actor is tracked specifically by Kaspersky for its focus on Russian-related targets.
* **Known Associations:** The group is characterized by its use of customized toolkits and a focus on espionage through the compromise of communication platforms.
## Activity Summary
Recent campaigns involve the distribution of a new malware suite dubbed the **Still Toolkit**. The campaign utilizes social engineering themes related to **fundraising efforts** (likely related to military or regional conflicts) to lure victims into executing malicious payloads. The primary goal of this specific operation is the exfiltration of Telegram session data and environmental eavesdropping.
## Tactics, Techniques & Procedures
* **Phishing/Social Engineering:** Uses lure documents or links related to fundraising to trick users.
* **Data Exfiltration (Telegram):** Specific routines to steal Telegram desktop session files (`key_datas`, `map*`, `settings*`) to hijack accounts.
* **Eavesdropping:** Capability to record audio or monitor victim surroundings via the "Still Toolkit."
* **Persistence:** Use of scheduled tasks or registry modifications to maintain access.
* **LNK File Execution:** Use of malicious shortcut files to trigger the infection chain.
* **PowerShell Utilization:** Leverages PowerShell scripts for downloader functionality and system reconnaissance.
## Targeting
* **Sectors:** Government, Military, and NGOs/Volunteer organizations.
* **Geography:** Primarily Russia and potentially surrounding regions involved in regional conflicts.
* **Victims:** Users participating in or interested in military fundraising and humanitarian aid efforts.
## Tools & Infrastructure
* **Malware Families:**
* **Still Toolkit:** A new, modular espionage framework.
* **StillDownloader:** Initial stager used to fetch the main payload.
* **Infrastructure:**
* **C2 Domains:** `cloud-storage-service[.]com`, `data-transfer-portal[.]net` (Example defanged formats).
* **IP Addresses:** Often utilizes rented VPS infrastructure to host payloads.
* **Storage:** Use of legitimate cloud services (e.g., GitHub or Telegram) for hosting second-stage components.
## Implications
Armored Likho demonstrates a sophisticated focus on "low-noise" espionage. By targeting Telegram, they bypass traditional email-based monitoring and gain access to real-time, often unencrypted communications used by field personnel and volunteers. The transition to the Still Toolkit indicates an evolution in their development capabilities, moving toward more specialized, modular code.
## Mitigations
* **Application Whitelisting:** Restrict the execution of unsigned LNK files and PowerShell scripts from non-standard directories (e.g., `%TEMP%` or `%APPDATA%`).
* **Telegram Security:** Enable Two-Step Verification (2FA) on Telegram and regularly check "Active Sessions" for unauthorized devices.
* **Endpoint Detection (EDR):** Monitor for unusual processes accessing Telegram data folders (`%USERPROFILE%\AppData\Roaming\Telegram Desktop\tdata`).
* **Network Filtering:** Block known C2 infrastructure and monitor for outbound traffic to suspicious cloud-hosting providers.
* **User Training:** Educate staff on the risks of clicking links in unsolicited messages regarding fundraising or urgent military aid.