As rival WhatsApp has caused controversy over privacy issues, the cloud-based social platform Telegram has become popular this year and has become the most downloaded application in the world during the January 2021 eclipse. It has been installed more than 63 million times and has more than 500 million monthly active users. This popularity also extends to the cybercriminal sector, with more and more malware creators using Telegram as a ready-made command and control (C&C) system.
Telegram has become a new active platform for hackers, and research has found that dozens of malicious viruses are spread through it
As early as 2017, the first use of Telegram as a C&C base system was to steal Masad, and according to security research units Check Point The discussion also summarized the advantages of using popular IM services as a part of the attack:
- Telegram is a legal, easy-to-use, and stable service that is not blocked by corporate antivirus engines or network management tools
- Since the registration process only requires entering a mobile phone number, attackers can remain anonymous
- Telegram’s unique messaging menu makes it easy for attackers to filter data from a victim’s PC or transfer new malicious files to an infected computer
- Telegram also enables attackers to use their mobile devices to access infected computers from virtually anywhere in the world
In the past three months, Check Point has identified more than 130 attacks using a new versatile remote access Trojan called “Toxic Eye.” The Trojan is delivered via phishing emails containing a malicious .exe and is managed by the attacker via Telegram, communicating with the attacker’s C&C server and passing data to it. As long as the user opens the attachment, Toxic Eye will automatically be installed on the user’s computer and perform a series of exploits without your knowledge, including stealing data, deleting or transferring files, closing processes on the PC, hijacking the computer’s lens and microphone to record videos and audio, encrypting files to demand ransom, etc.
The infection process of Toxic Eye is as follows. The attacker first creates a Telegram account and a Telegram bot. The Telegram bot account is a special remote account. Users can interact through chat or add it to a group, or send requests directly from the input field by typing the Telegram username and query into the program. The bot is embedded in Toxic Eye’s RAT profile and assembled into an executable file. Any victim infected with this malicious virus is at risk of being attacked by a Telegram bot that uses Telegram to connect the user’s device to the attacker’s C&C. Additionally, malicious files displayed in phishing emails can be downloaded and executed by opening them.
If you want to view the complete research report, you can move to Check Point. Here I would like to remind everyone that no platform or tool in the world is absolutely safe. You must stay alert when using it to protect your own safety.
◎Data source:Check Point
Source: KOCPC Chinese