Netskope Threat Labs researchers discovered a Golang-based backdoor using Telegram for C2 communication, possibly of Russian origin.
Netskope Threat Labs found a Golang-based backdoor using Telegram for C2. The malware, still in development but functional, exploits cloud apps to evade detection. The experts believe the new Go backdoor could have a Russian origin.
Upon executing the malware, it acts like a backdoor, it relocated itself to “C:\Windows\Temp\svchost.exe” if not already there, then launches a new copy before terminating.
The malicious code connects to Telegram using an open-source Go package and creates a bot instance, retrieves updates, and listens for commands.
The library supports Golang bindings for the Telegram Bot API.
“The malware supports four different commands but only three are in fact implemented. The following table gives a brief description of each of these commands.
| Command | Description |
|---|---|
| /cmd | Execute commands via powershell |
| /persist | Relaunch itself under C:\Windows\Temp\svchost.exe |
| /screenshot | Not implemented |
| /selfdestruct | Delete itself |
All the commands output are sent to the Telegram channel via the Send package function which is called in the “sendEncrypted” malware function.” reads the report published by Netskope.
“The command “/cmd” is the only one that requires 2 chat messages, with the first being the command itself and the next one the PowerShell command to be executed.”
The malware waits for a PowerShell command from Telegram and executes it. It can also relaunch itself, send fake screenshot messages, and self-destruct by deleting its file and terminating.
The attribution to a Russian origin is based on the “/cmd” instruction, which sends “Enter the command:” in Russian to the chat.
“The use of cloud apps presents a complex challenge to defenders and attackers are aware of it. Other aspects such as how easy it is to set and start the use of the app are examples of why attackers use applications like that in different phases of an attack.” concludes the report that includes indicators of compromise (IoCs).
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Golang-based backdoor)
