The dropped payload performs the following actions upon execution.

We have analyzed the Epsilon ransomware loader in which execution starts with dropping an. We have seen multiple payloads being used in recent campaigns, primarily consisting of these four: Worse, a file sent from Discord is there forever, so even if an attacker deletes a file within Discord, its link can still be used to download the malicious file.įigure 2: Infection chain of different malware on

For example, an attacker can upload a malicious file on a Discord channel and share its public link with others- even non-Discord users can download it.

This CDN service was actually started as a content distribution network for serving static content to users, but it has revealed some considerable risks. But attackers also use Discord, often to distribute malicious files and steal information. Users can communicate with voice calls, chat messages, and video calls as well as send files to one another. This campaign uses Discord services to form a URL to host malicious payloads as follows: įigure 1: Malicious files blocked in the Zscaler cloud served via ĭiscord is a chat application that allows users to chat with each other in real time. It’s worth noting, however, that using Discord to host payloads is not new. The attack usually starts with spam emails in which users are tricked with legitimate-looking templates into downloading next-stage payloads.

Multiple categories of malware are being served through the Discord app’s CDN infrastructure - ransomware, stealers, and cryptominers.

File icons are also related to gaming software to trick gamers.

Malicious files are renamed as pirated software or gaming software to trick gamers.

Cybercriminals are using Discord CDN to host malicious files as well as for command-and-control (C&C) communication.

Multiple campaigns relying on the service for their infection chain.

The key findings of our research include: Recently, the Zscaler ThreatLabZ team noticed new campaigns in which cybercriminals are targeting gamers. Attackers have often exploited the popularity of certain games ( Among Us was a recent example) to lure players into downloading fake versions that served malware.

People of all ages turned online for school and work, to stream videos, to play video games, have virtual get-togethers, shop, talk to their doctor, and engage in any number of other activities.ĭuring 2020, research showed a sharp increase in game downloads, and this activity did not go unnoticed by cybercriminals. Since the onset of the pandemic, the internet has become a central part of our lives.

Discordapp website