New Golang-Based Backdoor Uses Telegram Bot API for Evasive C2 Operations

Avatar
Cybersecurity researchers have shed light on a new Golang-based backdoor that uses Telegram as a mechanism for command-and-control (C2) communications. Netskope Threat Labs, which detailed the functions of the malware, described it as possibly of Russian origin. “The malware is compiled in Golang and once executed it acts like a backdoor,” security researcher Leandro Fróes said in an analysis
[[{“value”:”

Cybersecurity researchers have shed light on a new Golang-based backdoor that uses Telegram as a mechanism for command-and-control (C2) communications.

Netskope Threat Labs, which detailed the functions of the malware, described it as possibly of Russian origin.

“The malware is compiled in Golang and once executed it acts like a backdoor,” security researcher Leandro Fróes said in an analysis published last week. “Although the malware seems to still be under development it is completely functional.”

Once launched, the backdoor is designed to check if it’s running under a specific location and using a specific name – “C:WindowsTempsvchost.exe” – and if not, it reads its own contents, writes them to that location, and creates a new process to launch the copied version and terminate itself.

A notable aspect of the malware is that it uses an open-source library that offers Golang bindings for the Telegram Bot API for C2 purposes.

This involves interacting with the Telegram Bot API to receive new commands originating from an actor-controlled chat. It supports four different commands, although only three of them are currently implemented –

/cmd – Execute commands via PowerShell
/persist – Relaunch itself under “C:WindowsTempsvchost.exe”
/screenshot – Not implemented
/selfdestruct – Delete the “C:WindowsTempsvchost.exe” file and terminate itself

The output of these commands is sent back to the Telegram channel. Netskope said that the “/screenshot” command sends the message “Screenshot captured” despite it not being fully fleshed out.

The Russian roots of the malware are explained by the fact that the “/cmd” instruction sends the message “Enter the command:” in Russian to the chat.

“The use of cloud apps presents a complex challenge to defenders and attackers are aware of it,” Fróes said. “Other aspects such as how easy it is to set and start the use of the app are examples of why attackers use applications like that in different phases of an attack.”

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

“}]] The Hacker News 

Total
0
Shares
Previous Post

Estonian spy chief: ‘Hybrid schmybrid, what’s happening is attacks’

Next Post

⚡ THN Weekly Recap: Google Secrets Stolen, Windows Hack, New Crypto Scams and More

Related Posts

5,000 Phishing PDFs on 260 Domains Distribute Lumma Stealer via Fake CAPTCHAs

Cybersecurity researchers have uncovered a widespread phishing campaign that uses fake CAPTCHA images shared via PDF documents hosted on Webflow's content delivery network (CDN) to deliver the Lumma stealer malware. Netskope Threat Labs said it discovered 260 unique domains hosting 5,000 phishing PDF files that redirect victims to malicious websites. "The attacker uses SEO to trick victims into
Avatar
Read More

Webinar: Learn How ASPM Transforms Application Security from Reactive to Proactive

Are you tired of dealing with outdated security tools that never seem to give you the full picture? You’re not alone. Many organizations struggle with piecing together scattered information, leaving your apps vulnerable to modern threats. That’s why we’re excited to introduce a smarter, unified approach: Application Security Posture Management (ASPM). ASPM brings together the best of both
Avatar
Read More