Armored Likho Deploys New 'Still Toolkit' in Targeted Telegram Data Exfiltration Campaign

Executive Summary

On September 1, 2026, threat intelligence researchers identified a sophisticated new campaign attributed to the threat actor known as Armored Likho. This campaign utilizes a previously undocumented malware suite dubbed the "Still Toolkit." The primary objective of this operation appears to be the systematic exfiltration of Telegram session data and the real-time monitoring of private communications. The campaign leverages social engineering, specifically fraudulent fundraising appeals, to lure victims into executing the malicious payload. This development marks a significant evolution in the group's technical capabilities and targeting precision.

Threat Analysis

Armored Likho has historically focused on regional espionage, and this latest iteration demonstrates a refined approach to compromising secure messaging platforms. By masquerading as legitimate charitable organizations or community fundraising efforts, the actors exploit the trust of their targets. Once the victim interacts with the lure—often a malicious document or a link to a spoofed donation portal—the Still Toolkit is deployed to the system. Unlike generic info-stealers, this toolkit is highly specialized, focusing on the persistence and extraction of communication metadata and message history from the Telegram desktop application. The campaign is currently active, with a high volume of lures detected in the last 48 hours.

Technical Details

The Still Toolkit is a modular framework written in C++. Its primary component is a stealthy loader that establishes persistence via registry key modification and scheduled tasks. Once active, the malware scans the local filesystem for the tdata directory associated with Telegram Desktop. It specifically targets the map* and D877F783D5D3EF8C* files, which contain encrypted session keys and local databases.

The toolkit includes a custom exfiltration module that uses HTTPS POST requests to send compressed archives of the stolen data to a hardcoded Command and Control (C2) server. Additionally, the toolkit features an "eavesdropping" module capable of capturing screenshots when the Telegram window is in focus, providing the attackers with visual context of the conversations. The malware also employs advanced anti-analysis techniques, including environment checks to detect virtual machines and sandboxes, which delays execution if a monitoring environment is detected.

Attribution Assessment

Researchers at Kaspersky have attributed this activity to Armored Likho with high confidence. This assessment is based on significant overlaps in the C2 infrastructure, specifically the use of certain IP ranges and domain registration patterns previously associated with the group's "Likho" operations. Furthermore, the code structure of the Still Toolkit shares obfuscation techniques and string encryption routines found in earlier versions of the group's custom backdoors. The targeting profile—focusing on individuals involved in regional political and social discourse—remains consistent with the group's established strategic objectives.

Implications

The emergence of the Still Toolkit highlights a growing trend where threat actors develop bespoke tools for specific high-value applications rather than relying on broad-spectrum malware. As Telegram is often perceived as a secure alternative to traditional messaging, this campaign poses a significant risk to journalists, activists, and government officials who rely on the platform for confidential communication. The use of social engineering lures related to fundraising suggests the actor is adept at exploiting current regional tensions to increase infection rates, making the threat particularly potent during periods of social unrest.

Recommendations

Encrygma recommends that organizations and high-risk individuals implement the following defensive measures:

1. Enable Two-Step Verification (2FA): Ensure 2FA is active on Telegram to prevent session hijacking even if local data is compromised.
2. Session Management: Regularly audit and clear active sessions within the Telegram privacy settings to terminate unauthorized access.
3. Endpoint Monitoring: Deploy Endpoint Detection and Response (EDR) solutions configured to alert on unauthorized access to application data directories, specifically %APPDATA%\Telegram Desktop\tdata.
4. Security Awareness: Conduct targeted training focusing on the risks of unsolicited fundraising links and the dangers of executing unsigned binaries from community forums.
5. Network Filtering: Block known C2 indicators and monitor for unusual HTTPS POST traffic to unfamiliar domains.