Three concurrent OTX pulses paint a coherent picture of an escalating credential-theft and surveillance ecosystem. The most significant is the Armored Likho (a.k.a. Eagle Werewolf) cyber-espionage campaign, which in May 2026 began deploying a brand-new Rust-written malware family set dubbed the Still Toolkit — comprising Still Sync (file/credential exfiltration), Still Audio (microphone eavesdropping), and AquilaRAT (remote access) — against Russian government, technology, and education targets, including a dedicated Telegram session stealer. Initial access is achieved through trojanized fake donation-service applications, a social-engineering lure designed to exploit wartime charity sentiment.

Running in parallel, LevelBlue SpiderLabs telemetry documents multi-stage phishing redirection chains that abuse trusted cloud infrastructure — Framer no-code sites chained to Cloudflare Workers — delivering credential-harvesting pages through HTML smuggling via the Blob API and payload decryption via the Web Crypto API. This mirrors the device-code phishing and brand-impersonation tradecraft now standard in credential-theft-as-a-service operations.

Finally, a fraud campaign impersonating Tomorrowland Belgium 2026 demonstrates the commoditized end of the same pipeline: roughly a dozen lookalike domains running fake ticket shops with countdown timers and bogus "biometric verification" flows, harvesting payment card data and personal information from victims across Belgium, Czechia, France, and Sweden.

Collectively, these pulses show both nation-state and crimeware operators converging on the same objective — harvested credentials, session tokens, and payment data — through increasingly legitimate-looking infrastructure that defeats naive domain-reputation controls.

Threat Actor / Malware Profile

Armored Likho — Still Toolkit (Still Sync / Still Audio / AquilaRAT)

Attribution: Armored Likho (Eagle Werewolf), an espionage-motivated actor targeting Russian domestic entities — corporations, public sector, IT firms, universities, and private individuals.
Distribution: Fake donation-service applications delivered as the initial infection vector; lures impersonate charitable payment portals.
Payload behavior: The toolkit is written in Rust, complicating static signature detection and reversing. Still Sync performs staged file collection and synchronization of documents and credentials to attacker infrastructure. Still Audio activates the microphone for ambient audio surveillance — a classic APT espionage capability. AquilaRAT provides interactive remote control, secondary payload staging, and includes a dedicated Telegram session stealer that extracts tdata session files, enabling full account hijack without the victim's password or 2FA.
C2 communication: Outbound beaconing to a distributed pool of VPS-hosted IPv4 infrastructure (see IOCs below). Rust's native TLS stack is used to blend with legitimate HTTPS egress.
Persistence: Registry Run keys and scheduled tasks under innocuous names masquerading as sync/update services.
Anti-analysis: Rust compilation strips convenient string artifacts; payloads include environment checks and delayed execution before enabling the audio capture module.

Multi-Stage Phishing Relay Infrastructure

Distribution: Malicious links delivered via email and messaging, resolving through newly registered domains (NRDs) and long randomized URL paths.
Technique chain: Framer-hosted landing page → Cloudflare Worker relay → HTML smuggling using the Blob API to assemble the phishing page client-side → Web Crypto API used to decrypt the final credential-harvesting payload in-browser, defeating network-layer content inspection.
Objective: Credential capture via brand impersonation (DocuSign-style lures observed, e.g. the alasilla.com "docusignpaywet" path), plus device-code phishing against OAuth flows.

Tomorrowland 2026 Ticket Fraud Cluster

Distribution: Typosquatted and combo-squatted domains (belgium-tomorrowlland.com, belgiumtomoorrowland.com, tmrlnd.shop) promoted via social media ads and search poisoning.
Behavior: Fake ticket shops with countdown timers to induce urgency, fraudulent "biometric verification" steps to harvest identity data, and payment skimming at checkout.

IOC Analysis

The pulses contain four indicator classes requiring distinct handling:

IPv4 C2 addresses (Armored Likho): 213.252.244.123, 159.198.37.74, 23.26.237.250, 23.27.24.30, 145.223.69.143, 145.223.68.66. These are VPS-hosted nodes — block at egress firewall and proxy, and retro-hunt NetFlow/proxy logs for 90 days. Low false-positive risk.
File hashes (MD5): c1d1ee16b92e6a138ffa048855f75d7d, 17674b250d8b422a50a86c9ff207186d. MD5 values are brittle to recompilation but useful for retro-hunting; submit to your sandbox and pivot to behavioral detection given Rust recompilation ease.
Phishing domains/hostnames: 2934523t5234535323973294afhdsfga.com, bl.dase7.shop, alasilla.com, plus the Tomorrowland cluster (tomorrowland-booking.com, belgium-tomorrowlland.com/.info, belgiumtomoorrowland.com, jedemenatomorrowland.cz, tmrlnd.shop, mcsdirect.tech, festreisen.com). Note the DGA-like name and the .shop/.tech TLD concentration — enforce NRD blocking policies.
Full URLs: Extremely long randomized path segments (60+ character numeric/alpha strings) are a strong pivot point — hunt proxy logs for path-length anomalies rather than exact-match URLs, since these rotate.

Operationalization: Feed IPv4s and hashes to EDR/blocklists via API; domains to DNS sinkhole and secure web gateway; URL patterns into proxy regex rules. Tools: OTX DirectConnect for automated indicator sync, MISP for correlation, urlscan.io for live phishing page analysis, and VirusTotal/Intezer for Rust binary triage (Intezer's code-reuse analysis is particularly effective on Rust samples).

Detection Engineering

YAML

---
title: Armored Likho Still Toolkit - Telegram Session Theft
description: Detects access to Telegram tdata session files by non-Telegram processes, consistent with AquilaRAT Telegram stealer behavior
id: 9a1c4e2d-3b5f-4a8c-9e1d-armoredlikho01
status: experimental
author: Security Arsenal
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Telegram Desktop\tdata\'
  filter_legit:
    Image|endswith: '\Telegram.exe'
  condition: selection_path and not filter_legit
falsepositives:
  - Backup software
  - Forensic tooling
level: high
tags:
  - attack.credential_access
  - attack.t1552
  - attack.t1555
---
title: Suspicious Rust-Based Malware Execution from User Profile Directories
description: Detects unsigned binaries executing from AppData/Roaming or Temp with sync or audio-themed names, matching Still Sync / Still Audio staging patterns
id: 7f2b8d3a-1c4e-4b9a-8d2f-armoredlikho02
status: experimental
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
      - '\AppData\Roaming\'
      - '\AppData\Local\Temp\'
  selection_name:
    Image|contains:
      - 'stillsync'
      - 'stillaudio'
      - 'aquila'
      - 'donation'
  selection_unsigned:
    SignatureStatus: 'unsigned'
  condition: selection_path and (selection_name or selection_unsigned)
falsepositives:
  - Legitimate portable applications
level: medium
tags:
  - attack.execution
  - attack.t1059
  - attack.t1036
---
title: HTML Smuggling via Blob API in Browser Process
description: Detects browser processes creating script or HTML files in temp/downloads followed by immediate execution, indicative of multi-stage phishing HTML smuggling chains abusing Blob API and Cloudflare Workers
id: 4e6a9c1b-2d8f-4c3a-b7e5-phishrelay03
status: experimental
author: Security Arsenal
logsource:
  category: file_event
  product: windows
detection:
  selection_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  selection_file:
    TargetFilename|endswith:
      - '.html'
      - '.hta'
      - '.js'
      - '.iso'
      - '.zip'
  selection_dir:
    TargetFilename|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
  condition: selection_browser and selection_file and selection_dir
falsepositives:
  - Legitimate file downloads
level: medium
tags:
  - attack.initial_access
  - attack.t1204
  - attack.t1027
date: 2026/08/13

KQL — Microsoft Sentinel / Defender

// Security Arsenal — Armored Likho C2 & Phishing Relay Hunt
// Hunts network connections to Still Toolkit C2 and known phishing relay hosts
let LikhoC2 = dynamic(["213.252.244.123","159.198.37.74","23.26.237.250","23.27.24.30","145.223.69.143","145.223.68.66"]);
let PhishHosts = dynamic(["2934523t5234535323973294afhdsfga.com","bl.dase7.shop","alasilla.com","tomorrowland-booking.com","belgium-tomorrowlland.com","belgium-tomorrowlland.info","belgiumtomoorrowland.com","tmrlnd.shop","mcsdirect.tech","jedemenatomorrowland.cz","festreisen.com"]);
union isfuzzy=true
(DeviceNetworkEvents
 | where TimeGenerated > ago(14d)
 | where RemoteIP in (LikhoC2) or RemoteUrl has_any (PhishHosts)
 | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType),
(DeviceProcessEvents
 | where TimeGenerated > ago(14d)
 | where ProcessCommandLine has_any ("tdata", "telegram", "stillsync", "stillaudio", "aquila")
    or (FileName =~ "rundll32.exe" and ProcessCommandLine has "AppData")
 | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessFileName),
(DeviceFileEvents
 | where TimeGenerated > ago(14d)
 | where FolderPath has "Telegram Desktop\\tdata"
    and InitiatingProcessFileName !~ "Telegram.exe"
 | project TimeGenerated, DeviceName, InitiatingProcessFileName, FolderPath, FileName, SHA256)
| sort by TimeGenerated desc

PowerShell

# Security Arsenal — Still Toolkit & Phishing Relay IOC Hunt
# Run elevated on suspected endpoints. Checks persistence, Telegram session theft artifacts,
# suspicious AppData binaries, and network connections to known C2.

$likhoC2 = @("213.252.244.123","159.198.37.74","23.26.237.250","23.27.24.30","145.223.69.143","145.223.68.66")
$knownHashes = @("c1d1ee16b92e6a138ffa048855f75d7d","17674b250d8b422a50a86c9ff207186d")
$findings = @()

Write-Host "[*] Checking registry Run keys for suspicious persistence..." -ForegroundColor Cyan
$runKeys = @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
             "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run")
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key | Get-Member -MemberType NoteProperty | ForEach-Object {
            $val = (Get-ItemProperty $key).($_.Name)
            if ($val -match "AppData|Temp|stillsync|stillaudio|aquila|donat") {
                $findings += "[PERSISTENCE] $key :: $($_.Name) = $val"
            }
        }
    }
}

Write-Host "[*] Checking scheduled tasks for masqueraded sync/update tasks..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {
    $_.TaskName -match "sync|update|audio" -and
    ($_.Actions.Execute -match "AppData|Temp")
} | ForEach-Object {
    $findings += "[TASK] $($_.TaskName) -> $($_.Actions.Execute) $($_.Actions.Arguments)"
}

Write-Host "[*] Scanning AppData for unsigned executables and hashing against known IOCs..." -ForegroundColor Cyan
$scanPaths = @("$env:APPDATA", "$env:LOCALAPPDATA\Temp")
foreach ($p in $scanPaths) {
    Get-ChildItem $p -Recurse -Include *.exe,*.dll -ErrorAction SilentlyContinue | ForEach-Object {
        $sig = Get-AuthenticodeSignature $_.FullName
        $md5 = (Get-FileHash $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
        if ($knownHashes -contains $md5.ToLower()) {
            $findings += "[HASH-MATCH] $($_.FullName) MD5=$md5"
        } elseif ($sig.Status -ne "Valid" -and $_.Length -gt 500KB) {
            $findings += "[SUSPICIOUS-BIN] $($_.FullName) Size=$($_.Length) Sig=$($sig.Status)"
        }
    }
}

Write-Host "[*] Checking for non-Telegram access indicators on tdata session store..." -ForegroundColor Cyan
$tdata = "$env:APPDATA\Telegram Desktop\tdata"
if (Test-Path $tdata) {
    Get-ChildItem $tdata -ErrorAction SilentlyContinue | Where-Object {
        $_.LastWriteTime -gt (Get-Date).AddDays(-3)
    } | ForEach-Object { $findings += "[TDATA-RECENT-WRITE] $($_.FullName) @ $($_.LastWriteTime)" }
}

Write-Host "[*] Checking active/historical connections to Armored Likho C2..." -ForegroundColor Cyan
Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object {
    $likhoC2 -contains $_.RemoteAddress
} | ForEach-Object {
    $proc = (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName
    $findings += "[C2-CONNECTION] $($_.RemoteAddress):$($_.RemotePort) State=$($_.State) Process=$proc"
}

Write-Host "`n===== HUNT RESULTS =====" -ForegroundColor Yellow
if ($findings.Count -eq 0) { Write-Host "No indicators found." -ForegroundColor Green }
else { $findings | ForEach-Object { Write-Host $_ -ForegroundColor Red } }
$findings | Out-File "$env:TEMP\arsenal_hunt_$(Get-Date -Format yyyyMMdd_HHmm).txt"

Response Priorities

Immediate (0–4 hours):

Block all six Armored Likho C2 IPv4 addresses at the egress firewall, proxy, and DNS layers; sinkhole the phishing and fraud domains listed above.
Deploy the Sigma rules and execute the KQL hunt across the last 14 days; run the PowerShell hunt script on any host with outbound connections to the listed C2.
Alert on any non-Telegram.exe process touching tdata — treat as confirmed compromise.

Within 24 hours:

Because Still Toolkit includes a Telegram session stealer and the phishing relays target OAuth/device-code flows: force credential resets and session revocation (Telegram active sessions, Microsoft 365 refresh tokens, browser cookies) for any user on an affected host — password resets alone are insufficient against session theft.
Audit MFA enrollments and device-code grant activity in Entra ID for the affected population; revoke anomalous OAuth consents.
Contact any users who interacted with Tomorrowland-themed ticket sites; initiate payment card reissue where card data was entered.

Within 1 week:

Enforce a newly registered domain (NRD) block policy at the secure web gateway — the phishing relay and fraud clusters rely almost entirely on NRDs and low-reputation TLDs (.shop, .tech, .info).
Restrict outbound audio/microphone access via application control policies for non-approved processes (countering Still Audio).
Enable Cloudflare Workers / Framer egress alerting or category-based inspection for no-code hosting platforms in your proxy, and deploy TLS inspection on long-random-path URL patterns.
Conduct targeted user-awareness briefings on donation-themed lures and event-ticket fraud, and add Telegram tdata protection to EDR custom detection policies.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

Armored Likho Still Toolkit (Rust) + Multi-Stage Phishing Relay Chains: OTX Pulse Analysis — Enterprise Detection Pack