Discord webhook C2
Strings analysis of the thirty-percent-complete Go binary capture reveals a discord.com webhook address. The binary uses Discord as its command-and-control channel rather than a dedicated server, making it invisible to egress rules aimed at known-bad infrastructure.
The miner calls home through Discord.
Command-and-control traffic is expected on suspicious ports or unfamiliar infrastructure. This sample chose a platform most monitoring has no rules for.
Running strings on the largest capture — about thirty percent of a thirty-megabyte Go binary — yields a Discord dot com address in the output. The binary contains a webhook endpoint. A webhook is a single HTTPS POST to a Discord channel: no dedicated server, no domain to register, no infrastructure to stand up or defend. The attacker sends a message; Discord delivers it. The channel receives it like any other notification.
Standard egress filtering blocks known-bad domains and non-standard ports. A webhook to a consumer chat platform passes both checks.
Discord webhooks in malware are common enough now to filter for explicitly.
#linux#security#malware#honeypot#sysadmin
❯ Discord webhooks in malware are common enough now to filter for explicitly.