Threat actors are using the Tox P2P messenger as C2 server

guest · Sep 3, 2022

By Pierluigi Paganini - August 25, 2022

Tox is a peer-to-peer serverless instant messaging services that uses NaCl for encryption and decryption.

Uptycs researchers reported that threat actors have started using the Tox peer-to-peer instant messaging service as a command-and-control server. Tox has been used in the last months by threat actors as a communication channel between ransomware gangs and their victims.
Click to expand...

The researchers recently discovered an ELF sample that acts as a bot and can run scripts on the victim machine using the Tox protocol.
The binary is written in C and has only statically linked the c-toxcore library.

Experts reported that the dropped shell script contains commands to kill processes associated with cryptominer.
Click to expand...

The main function also includes a set of functions to set up the P2P instant messaging service on the victim’s machine, such as tox_new, tox_self_set_name, and tox_self_set_status_message.

“While the discussed sample does not do anything explicitly malicious, we feel that it might be a component of a coinminer campaign. We are observing it for the first time where Tox protocol is used to run scripts onto the machine.” concludes the report. “We have seen attackers using Tox as a communication mechanism in the past, like in HelloXD ransomware, where the attacker used Tox and onion-based messengers. Therefore, it becomes important to monitor the network components involved in the attack chains.“
Click to expand...

Uptycs Threat Research: Is Tox The New C&C Method For Coinminers?

Tox is a peer-to-peer serverless messaging system that uses NaCl for encryption and decryption. Since it’s serverless, it uses UDP and the DHT to find online peers, similar to what BitTorrent does. It is also meant to be anonymous, which means each user gets a public key that also acts as their ID within the system.

Tox has been used before by threat actors as a contact method, but in this case, Tox is being used for remote administration. The Uptycs threat research team recently found an ELF sample that acts as a bot and can run scripts on the victim machine using the Tox protocol.
Click to expand...

Log in or Sign up

Threat actors are using the Tox P2P messenger as C2 server

guest Guest

Log in or Sign up

Threat actors are using the Tox P2P messenger as C2 server

guest Guest

Useful Searches