Cybercriminals Using Telegram Messenger to Control ToxicEye Malware

Adversaries are increasingly abusing Telegram as a
“command-and-control” system to distribute malware into
organizations that could then be used to capture sensitive
information from targeted systems.

“Even when Telegram is not installed or being used, the system
allows hackers to send malicious commands and operations remotely
via the instant messaging app,” said researchers from cybersecurity
firm Check Point, who have identified no fewer than 130 attacks
over the past three months that make use of a new multi-functional
remote access trojan (RAT) called “ToxicEye.”

The use of Telegram for facilitating malicious activities is not
new. In September 2019, an information stealer dubbed Masad Stealer^[1]
was found to plunder information and cryptocurrency wallet data
from infected computers using Telegram as an exfiltration channel.
Then last year, Magecart groups^[2]
embraced the same tactic to send stolen payment details from
compromised websites back to the attackers.

The strategy also pays off in a number of ways. For a start,
Telegram is not only not blocked by enterprise antivirus engines,
the messaging app also allows attackers to remain anonymous, given
the registration process requires only a mobile number, thereby
giving them access to infected devices from virtually any location
across the world.

The latest campaign spotted by Check Point is no different.
Spread via phishing emails embedded with a malicious Windows
executable file, ToxicEye uses Telegram to communicate with the
command-and-control (C2) server and upload data to it. The malware
also sports a range of exploits that allows it to steal data,
transfer and delete files, terminate processes, deploy a keylogger,
hijack the computer’s microphone and camera to record audio and
video, and even encrypt files for a ransom.

Specifically, the attack chain commences with the creation of a
Telegram bot^[3]
by the attacker, which is then embedded into the RAT’s
configuration file, before compiling it into an executable (e.g.
“paypal checker by saint.exe”). This .EXE file is then injected
into a decoy Word document (“solution.doc”) that, when opened,
downloads and runs the Telegram RAT
(“C:\Users\ToxicEye\rat.exe”).

“We have discovered a growing trend where malware authors are
using the Telegram platform as an out-of-the-box
command-and-control system for malware distribution into
organizations,” Check Point R&D Group Manager Idan Sharabi
said. “We believe attackers are leveraging the fact that Telegram
is used and allowed in almost all organizations, utilizing this
system to perform cyber attacks, which can bypass security
restrictions.”