New Golang malware is hijacking Telegram to help itself spread

(Image credit: Shutterstock)

Netskope uncovers new Go-built backdoor spreading malware
It uses Telegram as its C2 infrastructure to send commands
The backdoor is most likely of Russian origin, experts warn

A new backdoor threat has been spotted using Telegram as its command-and-control (C2) infrastructure, researchers have warned.

Cybersecurity researchers from Netskope observed a new backdoor built in Golang, also known as Go, a programming language best known for its simplicity, concurrency support, and efficiency in building scalable backend systems, cloud services, and networking applications.

The backdoor is capable of executing PowerShell commands, can self-destruct, and checks for and executes predefined commands. However, what makes it really stand out from the crowd is its C2 infrastructure - it uses a special function to create a bot instance, using a Telegram API token generated via Botfather. Then, it uses a separate function to continuously listen for incoming commands from a Telegram chat. Before executing any predefined actions, the malware verifies the received command’s validity.

Challenging defense

Using Telegram, or other cloud services, as a C2 server is nothing new, the researchers explained, but it is dangerous, since it is difficult for security pros to differentiate between malicious and benign information flow.

“Although the use of cloud apps as C2 channels is not something we see every day, it’s a very effective method used by attackers not only because there’s no need to implement a whole infrastructure for it, making attackers’ lives easier, but also because it’s very difficult, from a defender perspective, to differentiate what is a normal user using an API and what is a C2 communication,” Netskope said in the article.

Besides Telegram, threat actors often use OneDrive, GitHub, Dropbox, and similar cloud apps, making defenders’ lives difficult.

Netskope did not discuss the number of potential victims, but did stress that the malware is most likely of Russian origin.

Microsoft says Russian hackers are exploiting an ancient printer security flaw
We've rounded up the best password managers
Take a look at our guide to the best authenticator app

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.