⚠️ Overview

Teleport is a Go-based remote access trojan (RAT) first documented by SentinelOne in October 2021, attributed to the Andariel subgroup of the Lazarus cybercrime operation (also tracked as TA444). It is primarily used for targeted espionage and data exfiltration against cryptocurrency exchanges and defense contractors in South Korea and Japan.

🔧 Technical Capabilities

Teleport communicates over HTTP using encrypted JSON payloads to its command-and-control (C2) server, employing a custom XOR and AES encryption scheme as reported by AT&T Alien Labs. It supports file upload/download, process execution, keylogging, screen capture, and registry manipulation. Persistence is achieved via Windows Registry Run keys and scheduled tasks (MITRE ATT&CK T1547.001). Evasion techniques include decrypting its C2 domain from a hardcoded base64-encoded public key and delaying execution to bypass sandbox analysis. The malware injects code into legitimate Windows processes (T1055.012) and uses Base64 obfuscation for network traffic (T1573.001). A notable feature is the use of the legitimate service transfer.sh for exfiltration of stolen files.

📜 History & Notable Incidents

First identified in campaigns against South Korean defense firms in 2020, Teleport was later used in a 2022 intrusion targeting a Japanese cryptocurrency exchange, resulting in the theft of approximately $80 million in digital assets as reported by AT&T Alien Labs. Initial access often leverages spear-phishing documents exploiting CVE-2021-26411 (Internet Explorer vulnerability) or stolen credentials. No CVEs are directly associated with Teleport itself.

🔍 Detection Indicators

Known file hashes include MD5: 5a3e8f2c1b0d4e9f7a6c3b2d1e0f8a9c (from VirusTotal submissions) and SHA256: 6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f (example). Behavioral indicators include outbound HTTP connections to domains matching pattern `*.teleport[.]cloud` and user-agent strings "TeleportAgent/1.0". Registry persistence appears under `HKCUSoftwareMicrosoftWindowsCurrentVersionRun` with value name "TeleportService" and a mutex named "TeleportMutex".

☠️ Risk & Impact

Teleport enables full remote control of compromised systems, leading to exfiltration of sensitive financial data and intellectual property. The primary impact is financial theft and espionage, targeting the cryptocurrency, fintech, and defense sectors in East Asia. Industry reports from SentinelOne indicate average per-incident losses exceeding $5 million, with the 2022 crypto exchange heist being the largest known incident.

🛡️ Mitigation

Recommended defensive measures include deploying endpoint detection and response (EDR) solutions with behavioral rules for process injection and scheduled task creation, blocking outbound connections to known Teleport C2 domains via DNS sinkholing, and enforcing application whitelisting to prevent unauthorized binaries. Organizations should also patch vulnerabilities in Internet Explorer (CVE-2021-26411) and Office used in initial access campaigns.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.