A recently discovered backdoor written in the Go programming language is abusing Telegram for command-and-control (C&C) communication, cybersecurity firm Netskope reports.
Still under development but fully functional, the Golang backdoor appears to have been created by a Russian developer, based on a message string it sends to the C&C server.
Prior to installation, an init function checks whether the backdoor is already running on the system, under a specific location. If not, it reads the malware contents, writes it to that location, creates a new process to launch the copy, and then terminates itself.
After execution, the backdoor uses a Telegram token to create a bot instance, then creates a channel that it constantly checks for new commands from its operator. The malware relies on an open source Go package to interact with Telegram.
According to Netskope, the malware checks whether a received command is valid by reviewing both the command length and the command itself.
The backdoor supports four commands, based on which it can execute commands via PowerShell, relaunch itself under the svchost.exe process, take screenshots (not implemented), and delete itself. It also sends command output to the Telegram channel.
Netskope discovered that two messages are required when the backdoor is instructed to execute commands via PowerShell, with the first one being the instruction and the second one the command to be executed, and that the malware responds to the first message with the string “Enter the command:” in Russian.
When receiving the command to relaunch itself, the backdoor performs the checks in the init function, and calls the function to relaunch and exit its process. Although the screenshot command is not implemented, the threat replies to it saying that the screenshot was successfully captured.
When instructed to self-destruct, the malware deletes the svchost.exe file in the Temp directory, and terminates itself while sending the “Self-destruct initiated” message to the Telegram channel.
Related: Fast-Growing Golang-Based ‘Kraken’ Botnet Emerges
Related: Crypto-Hijacking Campaign Leverages New Golang RAT
Related: Solana Web3.js Library Backdoored in Supply Chain Attack
Related: ShadowLogic Attack Targets AI Model Graphs to Create Codeless Backdoors
