Cybercriminals have found a new use for Discord (opens in new tab) according to MalwareHunterTeam whose researchers recently discovered that a remote access trojan (RAT) is now using the instant messaging and VoIP (opens in new tab) service as a command and control server.
This isn't the first time we've seen a trojan abuse Discord as earlier this year a new version of the AnarchyGrabber trojan (opens in new tab) was used to steal victim's plain text passwords and even command an infected client to spread malware to their Discord friends.
The new “Abaddon” remote access trojan is the first to use the popular messaging service as a full-fledged command and control server though. For those unfamiliar, command control (opens in new tab) (C&C) servers are remote hosts that are used to send commands to malware to be executed on an infected computer.
- We've put together a list of the best malware removal software (opens in new tab) around
- Secure your network with the best endpoint protection software (opens in new tab)
- Also check out our roundup of the best ransomware protection (opens in new tab)
When Abaddon is started on an infected device, the RAT first steals cookies, saved credit cards, credentials, Discord tokens and MFA information, file listings and system information from Chrome which is then used to compromise a user's online accounts.
After stealing user credentials and system data from an infected machine, Abaddon then connects to its command and control server via Discord to check for new commands to execute.
These commands tell the malware to perform a number of different actions including stealing a file or entire directories from a computer, getting a list of drives, opening a reverse shell to allow an attacker to execute commands on the infected machine, sending back collected information and more.
Every ten seconds Abaddon connects to its C2 server looking for new tasks to execute. By using Discord as a C2 server, the attackers behind this RAT can monitor infected PCs for new data and execute additional commands on them.
According to MalwareHunterTeam (opens in new tab), the threat actors behind Abaddon are also working on a new feature that will allow the RAT to deploy ransomware. Infecting computers with ransomware (opens in new tab) can be quite a lucrative business so this feature will likely be added to the malware soon.
- We've also highlighted the best antivirus (opens in new tab) software
Via BleepingComputer (opens in new tab)