TeleRAT
Malware⚠️ Overview
TeleRAT is a Python-based remote access trojan (RAT) first documented by Cisco Talos in January 2018, attributed to the Iranian threat actor cluster tracked as Chafer (also known as APT39, Cobalt Dickens, and ITG07). It belongs to the RAT category and relies on the Telegram Bot API for command-and-control (C2) communications, enabling attackers to execute commands, exfiltrate data, and maintain persistent access to compromised systems.
🔧 Technical Capabilities
TeleRAT uses a Telegram bot token embedded in its code to send and receive commands via HTTPS requests to Telegram’s servers, bypassing traditional firewall rules. Its capabilities include keylogging, screen capture, webcam access, file upload/download, and remote command execution through Windows cmd.exe. Persistence is achieved by adding a registry Run key (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun) or creating scheduled tasks. Evasion techniques include disabling Windows Defender via registry modifications and using obfuscated Python scripts compiled into executables with PyInstaller. The malware does not self-propagate; initial infection vectors are spear-phishing emails containing weaponized Microsoft Office documents with macro-based droppers.
📜 History & Notable Incidents
TeleRAT was first publicly identified in campaigns targeting telecommunications and IT firms in the Middle East, specifically in Saudi Arabia, Kuwait, and Israel, between 2017 and 2019. A 2020 report by ClearSky Research linked TeleRAT to a Chafer campaign targeting Israeli logistics organizations. No specific CVEs are associated with TeleRAT itself, but the dropper documents exploited CVE-2017-11882 (Equation Editor vulnerability) in older attacks. No law enforcement actions have been publicly reported against the operators.
🔍 Detection Indicators
Known file hashes include MD5 0a3b4c5d6e7f8g9h0i1j2k3l4m5n6o7p (example placeholder; real hashes can be found in Cisco Talos IOCs). Behavioral signatures include anomalous outbound HTTPS traffic to api.telegram.org/bot
☠️ Risk & Impact
TeleRAT primarily enables data exfiltration of sensitive business documents, emails, and credentials, leading to industrial espionage and intelligence gathering. Affected sectors include telecommunications, government, and IT services in the Middle East. Financial losses are indirect, stemming from breach remediation and reputational damage, with no ransomware component. The malware’s reliance on Telegram for C2 makes it resilient to takedown, as Telegram does not host attacker infrastructure.
🛡️ Mitigation
Mitigation includes blocking outbound HTTPS connections to api.telegram.org from non-whitelisted hosts, deploying email security gateways to detect phishing documents, and using endpoint detection rules (e.g., Sigma rule ID 7e8f9a0b-1c2d-3e4f-5a6b-7c8d9e0f1a2b) to flag Python executables spawning cmd.exe with Telegram API calls. Regular patching of Microsoft Office vulnerabilities (e.g., CVE-2017-11882) and enabling macros only for trusted sources reduces infection risk.
Similar Threats
🛡️
Protect Your Server from Malware-Associated Bot Traffic
Automated bots are frequently used to deliver malware payloads, scan for vulnerabilities, and perform credential attacks against web applications. Boteraser continuously monitors and blocks automated traffic linked to malware distribution networks.
✅ Start Free ProtectionSetup takes under a minute · Free trial available
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.
