New Golang-Based Backdoor Uses Telegram Bot API for Evasive C2 Operations

Cybersecurity researchers have shed light on a new Golang-based backdoor that uses Telegram as a mechanism for command-and-control (C2) communications.

Netskope Threat Labs, which detailed the functions of the malware, described it as possibly of Russian origin.

“The malware is compiled in Golang and once executed it acts like a backdoor,” security researcher Leandro Fróes said in an analysis published last week. “Although the malware seems to still be under development it is completely functional.”

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

Once launched, the backdoor is designed to check if it’s running under a specific location and using a specific name – “C:\Windows\Temp\svchost.exe” – and if not, it reads its own contents, writes them to that location, and creates a new process to launch the copied version and terminate itself.

A notable aspect of the malware is that it uses an open-source library that offers Golang bindings for the Telegram Bot API for C2 purposes.

This involves interacting with the Telegram Bot API to receive new commands originating from an actor-controlled chat. It supports four different commands, although only three of them are currently implemented –

• /cmd – Execute commands via PowerShell
• /persist – Relaunch itself under “C:\Windows\Temp\svchost.exe”
• /screenshot – Not implemented
• /selfdestruct – Delete the “C:\Windows\Temp\svchost.exe” file and terminate itself

The output of these commands is sent back to the Telegram channel. Netskope said that the “/screenshot” command sends the message “Screenshot captured” despite it not being fully fleshed out.

The Russian roots of the malware are explained by the fact that the “/cmd” instruction sends the message “Enter the command:” in Russian to the chat.

“The use of cloud apps presents a complex challenge to defenders and attackers are aware of it,” Fróes said. “Other aspects such as how easy it is to set and start the use of the app are examples of why attackers use applications like that in different phases of an attack.”

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.