telegramMalware
Last reported 10 days ago, by Group-IB17 reports
ATT&CK techniques
6 of 120 · each with the sentence it comes from- T1684Social Engineering
“This technique is not only a simple re-execution detection mechanism, but also a social engineering trick that deceives users into thinking something went wrong with the execution.”
- T1027Obfuscated Files or Information
“Sandbox Evasion (T1497.001), Obfuscated Files (T1027), Deobfuscate (T1140), Reflective Loading (T1620), Modify Registry (T1112), Hidden Window (T1564.003), File Deletion (T1070.004), Permissions Modification (T1222)”
- T1036Masquerading
“Masquerading [T1036]”
- T1056.001Keylogging
“Keylogging (T1056.001), Screen Capture (T1113), Clipboard Data (T1115), Archive via Library (T1560.002)”
- T1071.001Web Protocols
“Application Layer Protocol::Web Protocols [T1071.001]”
- T1082System Information Discovery
“System Info (T1082), Process (T1057), Software (T1518), Query Registry (T1012), System Owner/User (T1033), System Location (T1614/.001), Account (T1087), App Window (T1010), File & Directory (T1083)”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
17 reports, newest first · the exact sentence from each-
KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize“IP to their telegram bot.”
-
The Outsider Phishing Kit: A Resilient Threat in the Face of Law Enforcement Action“ChenLun’s Outsider telegram ecosystem showcasing active users before being taken down.”
-
Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode“…terminal": null, "filesystem": null, "processes": null, "windows": null, "asar": null, "ngc": null, "checker": null, "chromium": null, "telegram": null, "proxy": null, "reverseProxy": null, "server": null, "toast": null, "machine": null, "unattend": null, "winRE": null, "tools":…”
-
Millenium: A RAT Rewritten, A Threat Multiplied“/[ID]*gift*** - gift this bot to another user, his telegram bot has to be started”
-
From Cookies to Keys: The Threat of Session Hijacking“They're sold on underground marketplaces and private telegram channels.”
-
Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure“First advertised on the NOIRLEGACY GROUP telegram channel, EvilTokens spun up”
-
Operation Olalampo: Inside MuddyWater’s Latest Campaign“The final payload is CHAR rust backdoor that uses telegram bot as a C2 server.”
-
Empty Promises in MENA: How Online Quick Cash Schemes Exploit the Gig Economy“As discovered on this scheme, for each country there is a telegram channel and the responsible person who is responsible for validating the process and adding people.”
-
Choose Your Fighter: A New Stage in the Evolution of Android SMS Stealers in Uzbekistan“The research shows that the threat actors utilize stolen telegram sessions of Uzbek users sold on darkweb markets to spread the malware.”
-
The Crown Prince, Nezha“Whilst Huntress hasn’t been able to independently verify this claim, we have been able to identify a telegram channel which has more than 9,400 subscribers and appears to have been established in late 2021 as a way of sharing tips, tricks, cheap VPS’ available, and memes.”
-
A Vietnamese threat actor's shift from PXA Stealer to PureRAT“The telegram API is then used to send the resulting ZIP and message (above) to various Telegram chats, depending on the following logic:”
-
An Attacker’s Blunder Gave Us a Look Into Their Operations“Social media: Various telegram, X, and other social media posts read by the attacker.”
-
Fake Receipts Generators: the rising threat to major retail brands“A screenshot of the official maisonreceipts.cc telegram channel”
-
What Is a Combolist? How It Works, Risks, and Prevention“AlienTXT states that a private telegram channel contains “new and fresh data” but refuses to provide samples and evidence.”
-
The firming grip of cyber fraud in Asia: What effective actions must banks take today?“…reverse-engineered and added to play store, increase in mule accounts with users renting their national identity and bank accounts via telegram – are all some of the fraud challenges Group-IB’s teams have encountered in APAC over the last 6 months.”
-
Betting on Bots: Investigating Linux malware, crypto mining, and gambling API abuse“The threat actors utilized a mixture of tools and malware, including C2 channels disguised as kernel processes, telegram bots for communication, and cron jobs for scheduled task execution.”
-
Phishy Business: Unraveling LabHost’s scam ecosystem“@houdini13 in the already deleted telegram chat @NoirsRefunds was looking for Rolex, and in September he was already trying to refund it from Canada.”
Thanks — we review every report.