Malware researchers analyzed how Discord is being abused to download payloads and exfiltrate data, including a Ukrainian-targeted sample that points to emerging APT-like activity. The attack chain leverages Discord’s CDN to fetch a next-stage payload and Discord webhooks to covertly transfer stolen information back to attackers. Hashtags: #DiscordCDN #DiscordWebhooks #MercurialGrabber #UmbralStealer #GuLoader #Threatray #Trellix #dobroua
Keypoints
- Discord is being exploited as both a delivery vector (CDN) and a data-exfiltration channel (webhooks).
- A Ukrainian-critical-infrastructure-targeted sample suggests potential APT activity using Discord, marking a first observed case of this kind.
- Attackers upload a “second stage” payload to Discord CDN and retrieve it via HTTP GET from victims’ machines.
- Exfiltration is conducted through Discord webhooks, allowing data to be posted to a private server/channel.
- The infection chain starts with a phishing-like OneNote dropper, followed by a VBS that decrypts/executes PowerShell scripts and schedules daily tasks.
- Threat actors and families using Discord webhooks include MercurialGrabber, AgentTesla, UmbralStealer, and others; retro-hunting links DiscordWebhookClient usage to multiple samples.
MITRE Techniques
- [T1566.001] Phishing: Spearphishing Attachment – The sample was a OneNote file distributed via email to impersonate a Ukrainian NGO. Quote: “The sample was a OneNote file distributed via email with the name ‘dobroua.one’, to mimic the name of the non-profit Ukrainian organization dobro.ua.”
- [T1204.002] User Execution: Malicious File – The attacker executes an embedded Visual Basic Script (VBS) in the document. Quote: “This action will execute an embedded Visual Basic Script (VBS).”
- [T1053.005] Scheduled Task/Job: Scheduled Task – The VBS creates a daily scheduled task named ‘UpdateRoutine’ to run the script. Quote: “The embedded VBS creates a scheduled task called ‘UpdateRoutine’ that will execute the script on a daily basis (Figure 4).”
- [T1027] Obfuscated/Compressed Files or Information – The VBS decrypts a PowerShell script and uses a Base64-encoded payload. Quote: “The embedded VBS will decrypt a PowerShell script, which in turn contains another Base64 encoded PowerShell script.”‘
- [T1082] System Information Discovery – The final payload is a PowerShell script that gathers information from the system. Quote: “The final payload, a PowerShell script that gathers information from the system.”
- [T1105] Ingress Tool Transfer – The Base64-encoded PowerShell script downloads the next stage from GitHub. Quote: “The Base64 encoded PowerShell script will perform a web request to the GitHub repository ‘codelance’ by ‘sndhrqqw’ to download the ‘codelance.txt’.”
- [T1102] Web Service: Dead Drop Resolver – Discord webhooks act as a channel where exfiltration data is posted (web service dead drop). Quote: “The webhook URL is composed of two variables, the webhook ID… and the token ID… both mandatory for sending messages over it.”
- [T1071.001] Application Layer Protocol: Web Protocols – Discord traffic operates over HTTP/HTTPS, blending with normal web traffic. Quote: “Discord is a web-based application, which means it works over HTTP/HTTPS.”
- [T1020] Automated Exfiltration – Exfiltration is performed via Discord webhooks as an automated channel. Quote: “The exfiltration process over Discord is done using one of its automation features, webhooks.”
- [T1567] Exfiltration Over Web Service – Data is exfiltrated via Discord web services (webhooks). Quote: “Discord’s webhooks to exfiltrate the gathered data.”‘
Indicators of Compromise
- [SHA256] – 5fec8e1eaff88a80fd3841c17bcfabb752f5af794f0fc87f1b572db8de166cd6, 010e11f748663de4269fcbf42511e0879754c52959763b467d7e66d48e80fb3c, 9eebf0a378076a838e2dd300a7f147d2b3385a96f9d7baae4d1ae2e610d5ca4c, cebee012723d6e9f53757c6a1692fa3ffec93fe688c50e619242b55fa9825f691
- [MD5] – 8bb65823af768f5d85c8f58d9592a845, c68207e86aa7f6c7798e3de528dcfeb7, b80550d8b055be2173fdc541145e3a12, 5643c0d1dbdcfcce5512ef783f1c67b8
- [SHA1] – 74790694d671fba103fed1a346c531e313421652, 567c82f26e4469171e1e1746adaae9ad8d0e6d44, 2798a039f71fd47c5f89826bf6144420105e280c, 75e159ce9a865bf928562565066196b5ad6667cc
- [URL] – https://raw[.]githubusercontent[.]com/sndhrqqw/codelance/master/codelance, https://discord[.]com/api/webhooks/1106570095184052315/l2AtfWUd-YUVbgrl7z5oHRKLk7lVFFccddg3fu1k6nY5Vf7ttgcKvQhxTpUTi9eDj9B5
Read more: https://www.trellix.com/en-au/about/newsroom/stories/research/discord-i-want-to-play-a-game/