This nasty trojan uses Discord as a command and control server

Discord Desktop Client
(Image credit: Shutterstock / Konstantin Savusia)
Audio player loading…

Cybercriminals have found a new use for Discord (opens in new tab) according to MalwareHunterTeam whose researchers recently discovered that a remote access trojan (RAT) is now using the instant messaging and VoIP (opens in new tab) service as a command and control server.

This isn't the first time we've seen a trojan abuse Discord as earlier this year a new version of the AnarchyGrabber trojan (opens in new tab) was used to steal victim's plain text passwords and even command an infected client to spread malware to their Discord friends. 

The new “Abaddon” remote access trojan is the first to use the popular messaging service as a full-fledged command and control server though. For those unfamiliar, command control (opens in new tab) (C&C) servers are remote hosts that are used to send commands to malware to be executed on an infected computer.

When Abaddon is started on an infected device, the RAT first steals cookies, saved credit cards, credentials, Discord tokens and MFA information, file listings and system information from Chrome which is then used to compromise a user's online accounts.

Abaddon RAT

After stealing user credentials and system data from an infected machine, Abaddon then connects to its command and control server via Discord to check for new commands to execute.

These commands tell the malware to perform a number of different actions including stealing a file or entire directories from a computer, getting a list of drives, opening a reverse shell to allow an attacker to execute commands on the infected machine, sending back collected information and more.

Every ten seconds Abaddon connects to its C2 server looking for new tasks to execute. By using Discord as a C2 server, the attackers behind this RAT can monitor infected PCs for new data and execute additional commands on them.

According to MalwareHunterTeam (opens in new tab), the threat actors behind Abaddon are also working on a new feature that will allow the RAT to deploy ransomware. Infecting computers with ransomware (opens in new tab) can be quite a lucrative business so this feature will likely be added to the malware soon.

Via BleepingComputer (opens in new tab)

After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.