Abusing Electron-based applications in targeted attacks

Wednesday 4 October 15:00 - 15:30, Green room

Jaromir Horejsi (Trend Micro)

Electron is a popular framework for creating pseudo-native applications with web technologies like JavaScript, HTML and CSS. By packaging the application source codes with a particular version of Chromium (front-end part) and Node.js (back-end part), Electron allows applications to have just one codebase which can be run on different platforms (Windows, MacOS, and Linux).

This versatility and popularity has drawn the attention of threat actors, and we have observed several attacks against Electron-based applications, particularly supply chain ones.

In this presentation, we will look at the Electron framework (what it really is, from the developer's, end-user's, and defender's points of view) and discuss possible infection vectors – exploiting Chromium vulnerabilities, or trojanizing the Electron applications by replacing/patching the app.asar archive (containing application sources) to embed malicious code.

We will follow this with analyses of several real-life cases, which we recently researched, and which involved Electron-based applications.

These include:

• a secure chat application (MiMi chat) trojanized by the Iron Tiger threat actor, targeting Windows, Linux and MacOS secure chat users. The trojanized chat application becomes the downloader of additional native backdoors (HyperBro for Windows, rshell for Linux and MacOS).
• chat-based customer engagement platforms (Comm100 & LiveHelp100) trojanized by a currently unclassified threat actor. The trojanized applications download a multi-stage JavaScript payload, which later downloads a native multi-stage backdoor & stealer.
• a live chat application (MeiQia) vulnerable to CVE-2021-21220, then trojanized and exploited by the Water Labbu threat actor. The trojanized live chat application becomes the downloader of additional malware (custom batch scripts, Cobalt Strike, or system monitoring tool).

We will analyse not only the trojanized JavaScripts, but we will also briefly discuss the interesting native malware (custom backdoors, stealers, etc.).

Finally, we will talk about the targets of these campaigns, as well as the connections to previous campaigns operated by the mentioned threat actors.

• Download slides for this talk
• Download paper for this talk

Jaromir Horejsi Jaromir Horejsi is a senior threat researcher for Trend Micro Research. He specializes in tracking and reverse-engineering threats such as APTs, DDoS botnets, banking trojans, click fraud, and ransomware that target both Windows and Linux. His work has been presented at RSAC, SAS, Virus Bulletin, HITB, FIRST, AVAR, Botconf and CARO.

Back to VB2023 Programme page

Back to VB2023 conference page

Register for VB2023

Other VB2023 papers