A group of hackers is using a previously undocumented backdoor program designed to interact with attackers over Slack. While abusing legitimate services for malware command-and-control purposes is not a new development, this is the first time researchers have seen Slack, a popular enterprise collaboration tool, being used in this way.
The backdoor was detected by security firm Trend Micro in a targeted attack launched from the compromised website of an organization called the Korean American National Coordinating Council that posts articles related to North and South Korean politics. The technique of infecting websites that are of interest to a particular group of individuals or organizations is known as a “watering hole” attack.
It’s not clear if victims were directed to the website via an email campaign or if attackers just waited for regular visitors, but the site was modified to host an exploit for a remote code execution vulnerability in the Windows VBScript engine. That vulnerability is tracked as CVE-2018-8174 and can be exploited through Internet Explorer. However, the flaw was patched by Microsoft in May 2018, so having an up-to-date operating system would have prevented the attack.
In cases where the exploit ran successfully, it triggered a multi-stage infection chain that first involved downloading and executing a malicious DLL file via PowerShell. This first payload scanned for the presence of certain antivirus programs before deciding whether to download and install a new backdoor program that Trend Micro has dubbed SLUB (for Slack and GitHub, which the attackers use as a repository).
“Our investigation makes us believe with strong confidence that it was part of a possible targeted attack campaign,” the Trend Micro researchers said in their report. “So far, we have not been able to find related attacks and have not spotted the custom backdoor elsewhere. We have been searching for similar samples and have found none so far, which is a strong indication that the attackers either developed the malware or got it from a private developer who has not publicly leaked it.”
The backdoor program was used to collect information about victims and their activity on Twitter, Skype, KakaoTalk and bulletin board systems (BBS), but its features also included the ability to list and terminate processes, execute commands and malicious files, take screenshots, list and exfiltrate files, read and add system registry keys and collect information about storage drives and volumes, including whether they are encrypted or not.
The most interesting aspect of the malware remains its use of popular services to communicate with attackers. The backdoor connects to a GitHub repository to download commands and then connects to a Slack private workspace set up by the attackers to posts the output of those commands, along with the name of the computer the output was collected from. Finally, the malware uploads any stolen files to the file.io cloud storage service.
Attackers use Slack and GitHub to avoid detection
The reason why attackers used only legitimate services for command and control is likely because they wanted to evade network-level and even endpoint-level detection of potentially suspicious traffic. Of the abused services, Slack and GitHub are commonly used by companies and other types of organizations and are likely whitelisted in firewalls and Web security gateways. Furthermore, these services use HTTPS enabled by default, which means any data sent back to them is encrypted.
In the absence of solutions that can decrypt traffic at the network level, organizations are blind to the contents of HTTPS communications, the Trend Micro researchers said via email. “That’s the protocol doing its job. While this is good for protecting, say, banking transactions, in an enterprise setting it can pose issues.”
Slack has been notified and disabled the workspace set up by the attackers for violating the company’s terms of service. However, this will probably not be the last attack where hackers decide to abuse Slack’s service. The company provides APIs that can easily be used to integrate external applications with its service, and those applications can also include malware programs.
This story, “Hackers use Slack to hide malware communications” was originally published by CSO.