Armored Likho expands its cyber-espionage toolkit

MITRE Techniques

• [T1204 ] User Execution – The fake donation app relies on the victim entering a password and interacting with the lure to continue the infection (‘the app mimics a service for donations’ and ‘After the user enters a valid password’).
• [T1219 ] Remote Access Software – The toolkit enables continued access to Telegram accounts by stealing session data and using the Telegram API to access the victim’s account (‘steals Telegram session data to gain ongoing access to the victim’s account’).
• [T1056.001 ] Keylogging – Not used directly as a classic keylogger, but the implant captures user-authored Telegram communications and credentials-like session material through account access (‘steals Telegram session data’ and ‘pull chat logs’).
• [T1119 ] Automated Collection – Still Sync automatically pulls chat logs, media files, and other information from Telegram once it has access (‘automatically pull chat logs, media files, and other information from the account’).
• [T1005 ] Data from Local System – The malware searches local directories for Telegram tdata and collects files from disk (‘searches for the tdata folder’ and ‘pulls a list of files from the tdata folder’).
• [T1074.001 ] Local Data Staging – The implant prepares collected Telegram files and snapshots for server-side deduplication before exfiltration (‘This lets the C2 server avoid re-receiving files it already has’).
• [T1021.005 ] Remote Services: Telegram – The malware authenticates to Telegram and uses its API to access messages and media (‘authenticate to the chat app using the previously obtained tdata’).
• [T1041 ] Exfiltration Over C2 Channel – Collected Telegram data and audio recordings are sent to command-and-control servers (‘sends it in a POST request’ and ‘sends the recordings to a command-and-control server’).
• [T1123 ] Audio Capture – Still Audio records microphone audio when speech is detected (‘covert audio surveillance’ and ‘start recording voice when certain conditions are met’).
• [T1057 ] Process Discovery – The audio implant lists available input devices and selects one for recording (‘retrieves … a list of available audio input devices’ and ‘active_device’).
• [T1078 ] Valid Accounts – The attackers use stolen Telegram session data to log in as the victim (‘Sync can log in to the victim’s account’).
• [T1497.001 ] Virtualization/Sandbox Evasion: System Checks – The campaign collects detailed machine identifiers and system properties for registration and tracking (‘Motherboard serial number’, ‘CPU ID’, ‘System UUID’).
• [T1562.001 ] Impair Defenses – The malware uses backup and shadow-copy methods to access protected files when standard access fails (‘abuse the SeBackupPrivilege privilege’).
• [T1027 ] Obfuscated Files or Information – The GitHub-based C2 address is Base64-encoded and Blowfish-encrypted (‘the server URL Base64-encoded and encrypted with the Blowfish algorithm’).
• [T1105 ] Ingress Tool Transfer – The implant retrieves C2 configuration from GitHub when its server is unreachable (‘tries to pull the current C2 URL from a GitHub repository’).
• [T1584.001 ] Compromise Infrastructure: Domains – The operators register and use multiple lookalike domains for infrastructure (‘their domain names follow similar naming patterns that mimic Windows system services’).