Armored Likho 'Still Toolkit' Rust Espionage + Storm-3121 Passkey AiTM Phishing: OTX Pulse Analysis — Credential Theft Detection Pack

---
title: Armored Likho Still Toolkit - Suspicious Audio Capture via Non-Media Process
description: Detects microphone/audio capture initiated by suspicious processes consistent with the Still Audio surveillance module. Legitimate audio tools launched from user-writable or temp paths outside browser/communication apps are high-fidelity signals.
id: 7a3f1c2e-9b4d-4e8a-a1c5-stillaudio01
status: experimental
author: Security Arsenal Threat Intel
references:
  - https://securelist.com/armored-likho-still-toolkit/121033
date: 2026/09/12
logsource:
  category: process_creation
  product: windows
detection:
  selection_audio_tools:
    Image|endswith:
      - '\ffmpeg.exe'
      - '\sox.exe'
      - '\arecord.exe'
      - '\soundrecorder.exe'
    CommandLine|contains:
      - 'dshow'
      - 'audio='
      - 'waveaudio'
      - 'microphone'
  selection_suspicious_path:
    Image|contains:
      - '\AppData\Roaming\'
      - '\AppData\Local\Temp\'
      - '\ProgramData\'
      - '\Users\Public\'
  condition: selection_audio_tools and selection_suspicious_path
falsepositives:
  - Screen recording software installed by users (rare in temp/roaming paths)
level: high
tags:
  - attack.collection
  - attack.t1123
---
title: Armored Likho AquilaRAT - Known Still Toolkit Sample Execution
description: Detects execution of files matching known MD5 hashes of the Armored Likho Still Toolkit (Still Sync, Still Audio, AquilaRAT) published in OTX pulse data.
id: 8b4e2d3f-1c5a-4f9b-b2d6-aquilarat002
status: experimental
author: Security Arsenal Threat Intel
references:
  - https://securelist.com/armored-likho-still-toolkit/121033
date: 2026/09/12
logsource:
  category: process_creation
  product: windows
detection:
  selection_hashes:
    Hashes|contains:
      - 'MD5=c1d1ee16b92e6a138ffa048855f75d7d'
      - 'MD5=17674b250d8b422a50a86c9ff207186d'
      - 'MD5=62801f6223e860a7cca271522e303b2d'
      - 'MD5=68f0365d2fa8c828d012d8859e52a773'
      - 'MD5=4bd7c352ae277b0e38d07beedd4dd507'
      - 'MD5=d4bc09fb10ea2a5dc0bcbeeda5e5afdd'
      - 'MD5=2ca8adbab98ebe305eacf272cf48f5a0'
      - 'MD5=3ac41b097236a7723821848ae31ef141'
  condition: selection_hashes
falsepositives:
  - None expected; these are confirmed malware samples
level: critical
tags:
  - attack.execution
  - attack.t1204
  - attack.t1059
---
title: Storm-3121 Passkey-Themed AiTM Phishing Domain Resolution
description: Detects DNS queries to known Storm-3121/Storm-3032 passkey-themed phishing infrastructure and pattern-matching successor domains. Indicates a victim in an active AiTM or device-code phishing flow.
id: 9c5f3e4a-2d6b-5a0c-c3e7-passkey003
status: experimental
author: Security Arsenal Threat Intel
references:
  - https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/
date: 2026/09/12
logsource:
  category: dns
  product: windows
detection:
  selection_known:
    query|contains:
      - 'setupmypasskey.com'
      - 'validationsetupac.com'
      - 'portalsetuphub.com'
      - 'myconnectkey.com'
      - 'oskeysync.com'
      - 'keysyncos.com'
      - 'oskeyregister.com'
      - 'passkeyhelpdesk.com'
  condition: selection_known
falsepositives:
  - Threat researchers and security tooling validation
level: critical
tags:
  - attack.initial_access
  - attack.t1566
  - attack.t1557

// Storm-3121 / Storm-3032 Passkey AiTM phishing + unauthorized passkey registration hunt
// Sentinel: correlates endpoint connections to phishing infra with device-code sign-ins and new auth method registration
let PhishingDomains = dynamic([
  "setupmypasskey.com","validationsetupac.com","portalsetuphub.com","myconnectkey.com",
  "oskeysync.com","keysyncos.com","oskeyregister.com","passkeyhelpdesk.com"
]);
let EndpointHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl has_any (PhishingDomains)
    | project EndpointTime=TimeGenerated, DeviceName, AccountName=InitiatingProcessAccountName, RemoteUrl, InitiatingProcessFileName;
let DeviceCodeSignIns =
    SigninLogs
    | where TimeGenerated > ago(14d)
    | where AuthenticationProtocol has "deviceCode" or tostring(AuthenticationDetails) has "device code"
    | project SigninTime=TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, ResultType, Status;
let NewPasskeyReg =
    AuditLogs
    | where TimeGenerated > ago(14d)
    | where OperationName has_any ("Register security info", "Add FIDO2 security key", "Add passkey")
    | mv-expand TargetResources
    | extend UserPrincipalName = tostring(TargetResources.userPrincipalName)
    | project RegTime=TimeGenerated, UserPrincipalName, OperationName, InitiatedBy = tostring(InitiatedBy.user.userPrincipalName), IPAddress = tostring(InitiatedBy.user.ipAddress);
EndpointHits
| join kind=leftouter (DeviceCodeSignIns) on $left.AccountName contains $right.UserPrincipalName
| join kind=leftouter (NewPasskeyReg) on UserPrincipalName
| project EndpointTime, DeviceName, AccountName, RemoteUrl, SigninTime, IPAddress, RegTime, OperationName
| order by EndpointTime desc

# Security Arsenal - Armored Likho Still Toolkit + Storm-3121 IOC Hunt
# Run elevated on suspect endpoints. Outputs findings to console and hunt_results.txt

$Report = @()

# --- 1. Known Still Toolkit / AquilaRAT MD5 hashes ---
$MaliciousMD5 = @(
    "c1d1ee16b92e6a138ffa048855f75d7d",
    "17674b250d8b422a50a86c9ff207186d",
    "62801f6223e860a7cca271522e303b2d",
    "68f0365d2fa8c828d012d8859e52a773",
    "4bd7c352ae277b0e38d07beedd4dd507",
    "d4bc09fb10ea2a5dc0bcbeeda5e5afdd",
    "2ca8adbab98ebe305eacf272cf48f5a0",
    "3ac41b097236a7723821848ae31ef141"
)

$ScanPaths = @("$env:APPDATA", "$env:LOCALAPPDATA\Temp", "C:\ProgramData", "C:\Users\Public", "$env:USERPROFILE\Downloads")
foreach ($Path in $ScanPaths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -File -Include *.exe,*.dll -ErrorAction SilentlyContinue | ForEach-Object {
            try {
                $Hash = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction Stop).Hash.ToLower()
                if ($MaliciousMD5 -contains $Hash) {
                    $Report += "[CRITICAL] Known Still Toolkit sample: $($_.FullName) [MD5: $Hash]"
                }
            } catch {}
        }
    }
}

# --- 2. Phishing domain artifacts in DNS cache ---
$PhishDomains = @("setupmypasskey.com","validationsetupac.com","portalsetuphub.com","myconnectkey.com","oskeysync.com","keysyncos.com","oskeyregister.com","passkeyhelpdesk.com")
$DnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($Domain in $PhishDomains) {
    $Hit = $DnsCache | Where-Object { $_.Entry -like "*$Domain*" }
    if ($Hit) { $Report += "[CRITICAL] DNS cache hit for phishing domain: $Domain" }
}

# --- 3. Persistence: suspicious Run keys and scheduled tasks in user-writable paths ---
$RunKeys = @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run", "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run")
foreach ($Key in $RunKeys) {
    Get-ItemProperty -Path $Key -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object {
            $_.Value -match "AppData|Temp|ProgramData|Users\\Public" -and $_.Name -notmatch "^PS"
        } | ForEach-Object { $Report += "[HIGH] Suspicious Run key: $Key\$($_.Name) = $($_.Value)" }
    }
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    $_.Actions.Execute -match "AppData|Temp|Users\\Public" -and $_.State -ne "Disabled"
} | ForEach-Object { $Report += "[HIGH] Suspicious scheduled task: $($_.TaskName) -> $($_.Actions.Execute)" }

# --- 4. Telegram stealer indicator: non-Telegram processes with Telegram API connections ---
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    $Proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($Proc -and $Proc.ProcessName -notmatch "telegram|Telegram") {
        $Remote = (Resolve-DnsName -Name $_.RemoteAddress -ErrorAction SilentlyContinue).NameHost
        if ($Remote -match "telegram|t\.me") {
            $Report += "[HIGH] Non-Telegram process '$($Proc.ProcessName)' connected to $Remote from $($Proc.Path)"
        }
    }
}

if ($Report.Count -eq 0) { Write-Output "[CLEAN] No indicators found on $env:COMPUTERNAME" }
else { $Report | ForEach-Object { Write-Output $_ }; $Report | Out-File "hunt_results_$env:COMPUTERNAME.txt" }