Cybersecurity researchers have identified a new malware strain, dubbed NullZerepTool, that leverages the Telegram messaging platform as its command-and-control (C2) channel. This development underscores a growing trend among cybercriminals to exploit legitimate cloud-based services to manage and control malicious software.
NullZerepTool is a backdoor malware written in the Go programming language. Upon execution, it performs an initial self-installation by checking if it is running from a specific file path: C:\Windows\Temp\svchost.exe. If not, it copies itself to this location, relaunches the new instance, and terminates the original process. This self-installation step is executed through an initialization function before the main function of the malware is called.
To interact with Telegram, the malware employs an open-source Go package. It uses the NewBotAPIWithClient function to create a bot instance using a token generated via Telegram’s BotFather feature. The analyzed sample contained the token 8069094157:AAEyzkW_3R3C-tshfLwgdTYHEluwBxQnBuk. Through the GetUpdatesChan function, the malware continuously monitors a channel for incoming commands from its operators.
The backdoor currently supports four commands, three of which are fully implemented:
/cmd: Executes PowerShell commands received via Telegram./persist: Relaunches itself in the specified directory (C:\Windows\Temp\svchost.exe)./screenshot: Not yet fully implemented but sends a placeholder message indicating a screenshot was captured.
The use of Telegram as a C2 channel presents significant challenges for cybersecurity defenders. By leveraging a widely used and trusted platform, the malware’s communications blend in with legitimate traffic, making detection and mitigation more difficult. This tactic is not unique to NullZerepTool; other malware strains have similarly exploited Telegram for C2 purposes, highlighting a broader trend in cybercriminal strategies.
For instance, in a recent cyberespionage campaign, attackers turned Telegram bots into controllers for backdoors planted inside Middle Eastern government networks. The operation relied on familiar Windows components and legitimate-looking files, allowing attackers to establish access without immediately drawing attention. The infection began with an ISO image carrying a real ASUSTek RegSchdTask.exe program and a harmful companion DLL. When launched, the program loaded the attacker’s code, opening a multi-stage route that later delivered TELESHIM, MIXEDKEY, and the BINDCLOAK implant. TELESHIM used Telegram’s Bot API as its command channel, making malicious traffic resemble ordinary communications with a trusted online service.
Another example involves a Go-based backdoor that uses Telegram as its primary C2 communication channel. Despite being under development, the malware is operational and includes several implemented commands. It performs an initial self-installation process by checking if it is running from a specific file path and, if not, copies itself to this location, relaunches the new instance, and terminates the original process. The malware employs an open-source Go package to interact with Telegram, creating a bot instance using a token generated via Telegram’s BotFather feature. It continuously monitors a channel for incoming commands from its operators.
These instances illustrate a growing trend among cybercriminals to exploit legitimate cloud-based services like Telegram for C2 communications. This approach allows malicious traffic to blend in with normal network activity, complicating detection efforts. As such, organizations must remain vigilant and implement robust security measures to detect and mitigate such threats.
The emergence of NullZerepTool and similar malware strains underscores the need for continuous monitoring and adaptation of cybersecurity strategies. Organizations should consider implementing advanced threat detection systems capable of identifying anomalous behavior within legitimate services. Additionally, educating employees about the risks associated with seemingly benign applications and encouraging the use of multi-factor authentication can further enhance security postures.
