Thursday, March 28, 2024

ToxicEye RAT Uses Telegram to Steal Data from Victims and Perform Malicious Activities

Cybersecurity researchers have recently detected several attacks that are generally using a remote access virus through Telegram communications to steal data from victims and perform malicious activities on the infected devices.

The threat actors are using the Telegram messenger as a C&C server to spread malware to steal confidential information.

According to Checkpoint report, researchers have detected nearly 130 attacks in the past three months. And they say that the hackers are using Telegram to install a new multi-functional Trojan for remote access, “ToxicEye.”

However, the analysts have noted that the main reason for hacker activity is not a vulnerability that is present inside the messenger but the twist and turns of its architecture.

Moreover, the user who is very new to Telegram, those who have never used it can also become victims of such attacks.

Why are Hackers Using Telegram? 

The hackers are continuously targeting Telegram, and the attackers have many reasons in their bucket to target Telegram; here they are mentioned below:-

  • In Telegram, the threat actors can keep themselves hidden, or we can say that they can be anonymous because the registration process requires a phone number only.
  • The most common reason is that Telegram is a legitimate application; one can easily use this app.
  • One of the unique features of Telegram is that it has unique communication, through which the threat actors can exfiltrate data from victims’ PCs, or they can transfer all malicious files to infected machines. 
  • With the help of Telegram, the threat actors can use their mobile devices to access the computer that was infected.

Exploits performed by ToxicEye 

The experts have listed all the exploits that are performed by ToxicEye on the infected machine:-

  • Stealing data
  • Hijacking the PC’s microphone and camera to record audio and video
  • Deleting or transferring files
  • Killing processes on the PC
  • Encrypting files for ransom

Infection chain

The very first thing that is done by the threat actors is that they create an account, and along with that the hackers also open a Telegram ‘bot’, or special remote account.

However, with this special account, users can interact by Telegram chat or by adding them to Telegram groups, or simply sending requests directly from the input field by typing the bot’s Telegram username.

The analysts also aserted that the bot is embedded into the ToxicEye RAT configuration file, and later, it was attached and put into an executable file.

When the hacker is done with the installation process of the executable file, the threat actors can hijack the computer through the bot.

Functionalities of Telegram RAT

  • File system control 
  • I/O hijacking
  • Ransomware features
  • Data stealing features

How to spot infection and remain protected?

There are some points by which one can spot or know the infection, and also keep themselves protected.

  • Always check the traffic that is being generated from PCs in your organization to a Telegram C&C. As Telegram is not installed as an enterprise solution, and it gives a direct indication of attacks. 
  • Keep an eye on the attachments that are containing usernames, and be aware of these attachments as hackers use the username of the users to send malicious emails.
  • Always hunt for a file named as C:\Users\ToxicEye\rat.exe, the existence of this file means that the hackers have already attacked you, and infected your system.
  • Note the language of the email, as phishing attackers use different languages to convince the users.
  • In case, if there is no name in the place of the recipient means the attackers have attacked you.
  • Deploy an automated anti-phishing solution, as this kind of comprehensive coverage, is quite needed since phishing content can come over any medium.

The security researchers have urged the Telegram organizations and users to keep a brief knowledge of the latest phishing attacks and be highly suspicious of emails with a username or organization name that are embedded in the subject.

Website

Latest articles

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...

ZENHAMMER – First Rowhammer Attack Impacting Zen-based AMD Platforms

Despite AMD's growing market share with Zen CPUs, Rowhammer attacks were absent due to...

Airbus to Acquire INFODAS to Strengthen its Cybersecurity Portfolio

Airbus Defence and Space plans to acquire INFODAS, a leading cybersecurity and IT solutions...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles