Telegram is a popular messaging app that has seen user numbers soar in recent months, with many users of WhatsApp making the change to Telegram after recent changes to the WhatsApp privacy and data management policies.
Telegram has also proven popular with cybercriminals who are using the app for distributing and communicating with malware. Recently, a campaign has been identified involving a new malware variant dubbed ToxicEye. ToxicEye malware is a Remote Access Trojan (RAT) that gives an attacker full control of an infected device. The malware is used to steal sensitive data and download other malware variants.
The malware uses a Telegram account for its command and control server communications. Through the attacker’s Telegram account, they can communicate with a device infected with ToxicEye, exfiltrate data, and deliver additional malicious payloads.
It is easy to see the attraction with using Telegram for malware communication. First, the app is popular. The Telegram app was the most popular app in January 2021, having amassed more than 63 million downloads, and has around 500 million active users worldwide. During the pandemic the app has been adopted by many businesses who have been using it to allow their remote workers to communicate and collaborate. The app supports secure, private messaging and most businesses allow Telegram to be used and do not block or inspect communications.
Setting up a Telegram account is easy and attackers can remain anonymous. All that is required to set up an account is a mobile phone number, and the communication infrastructure allows attackers to easily exfiltrate data and send files to malware-infected devices undetected.
Telegram is also being used for distributing malware. Attackers can create an account, use a Telegram bot to interact with other users and send files, and it is also possible to send files to non-Telegram users via phishing emails with malicious attachments. It is phishing emails that are being used to deliver ToxicEye malware. Emails are sent with a .exe file attachment, with one campaign using a file named “paypal checker by saint.exe” to install the malware.
If the attachment is opened and run, a connection will be made to Telegram which allows malware to be downloaded by the attacker’s Telegram bot. The attackers can perform a range of malicious activities once the malware is installed, with the primary goals of the attackers being gathering information about the infected device, locating and exfiltrating passwords, and stealing cookies and browser histories.
ToxicEye malware can kill active processes and take control of Task Manager, record audio and video, steal clipboard contents, and deploy other malware variants – such as keyloggers and ransomware.
TitanHQ offers two solutions that can protect against ToxicEye and other Telegram-based phishing and malware campaigns. SpamTitan is a powerful email security solution that will block malicious emails delivering the executable files that install the ToxicEye RAT and other malware. For even greater protection, SpamTitan should be combined with WebTitan web security. WebTitan is a DNS-based web filtering solution that can be configured to block access to Telegram if it is not in use and monitor traffic in real time to identify potentially malicious communications.
For further information on both of these solutions, details of pricing, and to register for a free trial, contact TitanHQ today.