Hackers use Slack to hide malware communications

Credit: Dreamstime

A group of hackers is using a previously undocumented backdoor program designed to interact with attackers over Slack.

While abusing legitimate services for malware command-and-control purposes is not a new development, this is the first time researchers have seen Slack, a popular enterprise collaboration tool, being used in this way.

The backdoor was detected by security firm Trend Micro in a targeted attack launched from the compromised website of an organisation called the Korean American National Coordinating Council that posts articles related to North and South Korean politics.

The technique of infecting websites that are of interest to a particular group of individuals or organisations is known as a “watering hole” attack.

It’s not clear if victims were directed to the website via an email campaign or if attackers just waited for regular visitors, but the site was modified to host an exploit for a remote code execution vulnerability in the Windows VBScript engine.

That vulnerability is tracked as CVE-2018-8174 and can be exploited through Internet Explorer. However, the flaw was patched by Microsoft in May 2018, so having an up-to-date operating system would have prevented the attack.

In cases where the exploit ran successfully, it triggered a multi-stage infection chain that first involved downloading and executing a malicious DLL file via PowerShell.

This first payload scanned for the presence of certain antivirus programs before deciding whether to download and install a new backdoor program that Trend Micro has dubbed SLUB (for Slack and GitHub, which the attackers use as a repository).

“Our investigation makes us believe with strong confidence that it was part of a possible targeted attack campaign,” the Trend Micro researchers said in their report. “So far, we have not been able to find related attacks and have not spotted the custom backdoor elsewhere.

“We have been searching for similar samples and have found none so far, which is a strong indication that the attackers either developed the malware or got it from a private developer who has not publicly leaked it.”

The backdoor program was used to collect information about victims and their activity on Twitter, Skype, KakaoTalk and bulletin board systems (BBS), but its features also included the ability to list and terminate processes, execute commands and malicious files, take screenshots, list and exfiltrate files, read and add system registry keys and collect information about storage drives and volumes, including whether they are encrypted or not.