- Netskope uncovers new Go-built backdoor spreading malware
- It uses Telegram as its C2 infrastructure to send commands
- The backdoor is most likely of Russian origin, experts warn
A new backdoor threat has been spotted using Telegram as its command-and-control (C2) infrastructure, researchers have warned.
Cybersecurity researchers from Netskope observed a new backdoor built in Golang, also known as Go, a programming language best known for its simplicity, concurrency support, and efficiency in building scalable backend systems, cloud services, and networking applications.
The backdoor is capable of executing PowerShell commands, can self-destruct, and checks for and executes predefined commands. However, what makes it really stand out from the crowd is its C2 infrastructure – it uses a special function to create a bot instance, using a Telegram API token generated via Botfather. Then, it uses a separate function to continuously listen for incoming commands from a Telegram chat. Before executing any predefined actions, the malware verifies the received command’s validity.
Challenging defense
Using Telegram, or other cloud services, as a C2 server is nothing new, the researchers explained, but it is dangerous, since it is difficult for security pros to differentiate between malicious and benign information flow.
“Although the use of cloud apps as C2 channels is not something we see every day, it’s a very effective method used by attackers not only because there’s no need to implement a whole infrastructure for it, making attackers’ lives easier, but also because it’s very difficult, from a defender perspective, to differentiate what is a normal user using an API and what is a C2 communication,” Netskope said in the article.
Besides Telegram, threat actors often use OneDrive, GitHub, Dropbox, and similar cloud apps, making defenders’ lives difficult.
Netskope did not discuss the number of potential victims, but did stress that the malware is most likely of Russian origin.
