Cybercriminals have found a new use for Discord according to MalwareHunterTeam whose researchers recently discovered that a remote access trojan (RAT) is now using the instant messaging and VoIP service as a command and control server.
This isn’t the first time we’ve seen a trojan abuse Discord as earlier this year a new version of the AnarchyGrabber trojan was used to steal victim’s plain text passwords and even command an infected client to spread malware to their Discord friends.
The new “Abaddon” remote access trojan is the first to use the popular messaging service as a full-fledged command and control server though. For those unfamiliar, command control (C&C) servers are remote hosts that are used to send commands to malware to be executed on an infected computer.
When Abaddon is started on an infected device, the RAT first steals cookies, saved credit cards, credentials, Discord tokens and MFA information, file listings and system information from Chrome which is then used to compromise a user’s online accounts.
Abaddon RAT
After stealing user credentials and system data from an infected machine, Abaddon then connects to its command and control server via Discord to check for new commands to execute.
These commands tell the malware to perform a number of different actions including stealing a file or entire directories from a computer, getting a list of drives, opening a reverse shell to allow an attacker to execute commands on the infected machine, sending back collected information and more.
Every ten seconds Abaddon connects to its C2 server looking for new tasks to execute. By using Discord as a C2 server, the attackers behind this RAT can monitor infected PCs for new data and execute additional commands on them.
According to MalwareHunterTeam, the threat actors behind Abaddon are also working on a new feature that will allow the RAT to deploy ransomware. Infecting computers with ransomware can be quite a lucrative business so this feature will likely be added to the malware soon.
Via BleepingComputer