ToxicEye RAT Uses Telegram to Steal Data from Victims and Perform Malicious Activities

Cybersecurity researchers have recently detected several attacks that are generally using a remote access virus through Telegram communications to steal data from victims and perform malicious activities on the infected devices.

The threat actors are using the Telegram messenger as a C&C server to spread malware to steal confidential information.

According to Checkpoint report, researchers have detected nearly 130 attacks in the past three months. And they say that the hackers are using Telegram to install a new multi-functional Trojan for remote access, “ToxicEye.”

However, the analysts have noted that the main reason for hacker activity is not a vulnerability that is present inside the messenger but the twist and turns of its architecture.

Moreover, the user who is very new to Telegram, those who have never used it can also become victims of such attacks.

Why are Hackers Using Telegram?

The hackers are continuously targeting Telegram, and the attackers have many reasons in their bucket to target Telegram; here they are mentioned below:-

• In Telegram, the threat actors can keep themselves hidden, or we can say that they can be anonymous because the registration process requires a phone number only.
• The most common reason is that Telegram is a legitimate application; one can easily use this app.
• One of the unique features of Telegram is that it has unique communication, through which the threat actors can exfiltrate data from victims’ PCs, or they can transfer all malicious files to infected machines.
• With the help of Telegram, the threat actors can use their mobile devices to access the computer that was infected.

Exploits performed by ToxicEye

The experts have listed all the exploits that are performed by ToxicEye on the infected machine:-

• Stealing data
• Hijacking the PC’s microphone and camera to record audio and video
• Deleting or transferring files
• Killing processes on the PC
• Encrypting files for ransom

Infection chain

The very first thing that is done by the threat actors is that they create an account, and along with that the hackers also open a Telegram ‘bot’, or special remote account.

However, with this special account, users can interact by Telegram chat or by adding them to Telegram groups, or simply sending requests directly from the input field by typing the bot’s Telegram username.

The analysts also aserted that the bot is embedded into the ToxicEye RAT configuration file, and later, it was attached and put into an executable file.

When the hacker is done with the installation process of the executable file, the threat actors can hijack the computer through the bot.

Functionalities of Telegram RAT

• File system control
• I/O hijacking
• Ransomware features
• Data stealing features

How to spot infection and remain protected?

There are some points by which one can spot or know the infection, and also keep themselves protected.

• Always check the traffic that is being generated from PCs in your organization to a Telegram C&C. As Telegram is not installed as an enterprise solution, and it gives a direct indication of attacks.
• Keep an eye on the attachments that are containing usernames, and be aware of these attachments as hackers use the username of the users to send malicious emails.
• Always hunt for a file named as C:\Users\ToxicEye\rat.exe, the existence of this file means that the hackers have already attacked you, and infected your system.
• Note the language of the email, as phishing attackers use different languages to convince the users.
• In case, if there is no name in the place of the recipient means the attackers have attacked you.
• Deploy an automated anti-phishing solution, as this kind of comprehensive coverage, is quite needed since phishing content can come over any medium.

The security researchers have urged the Telegram organizations and users to keep a brief knowledge of the latest phishing attacks and be highly suspicious of emails with a username or organization name that are embedded in the subject.