Armored Likho, also known as Eagle Werewolf, has initiated a new cyberespionage campaign targeting individuals and organizations in Russia. The group employed fake donation applications as bait but is now concerned with its latest malware toolkit. This threat can steal Telegram session data, collect messages and media, and secretly record audio from infected Windows systems.
The campaign, detected in May 2026, affected both private users and entities within the public sector, IT, education, and large businesses. Researchers have linked this activity to previous Armored Likho operations through shared code, encryption methods, infrastructure patterns, and device-identification logic. It gathers system details such as the motherboard serial number, CPU ID, system UUID, BIOS serial number, and computer domain name.
Still Sync checks standard Telegram Desktop paths, Microsoft Store installation folders, and in some cases, broader locations on the disk. Once it gains Telegram session data, it can extract account details, private chats, group and channel information, messages, contacts, documents, photos, stickers, and other media under 250 MB using the Telegram API. Indicators of Compromise Type Indicator Details Dropper MD5 C1D1EE16B92E6A138FFA048855F75D7D Fake donation application Dropper MD5 17674B250D8B422A50A86C9FF207186D Fake donation application Securely integrate into authorized cybersecurity platforms like MISP, VirusTotal, or your Security Information and Event Management (SIEM) system.
Enhance your SOC’s effectiveness and decrease Mean Time To Resolution (MTTR) with comprehensive phishing visibility.
