This malware abuses Tor and Telegram infrastructure to evade detection
Agent Tesla can now conceal communications using Tor and dump stolen data to Telegram
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
For more than seven years, theAgent Teslafamily of remote access trojan (RAT)malwarehas remained one of the most common threats to Windows users online as it is continually updated by its creators.
A variety of cybercriminals leverage the malware to steal user credentials and other information through screenshots, keylogging and clipboard capture. However, as Agent Tesla’s compiler hard-codes operator-specific variables when its built, the malware’s behavior can vary widely as it continues to evolve.
According toSophos, recent changes to the malware increased the number of applications targeted for credential theft to include web browsers, email clients,VPNclients and other software that stores usernames and passwords.
SophosLabs has tracked multiple threat actors using Agent Tesla and as of December of last year, it accounted for 20 percent of malicious email attachments detected in the company’s customer telemetry.
Agent Tesla v3
In itsnew reporton Agent Tesla, Sophos sheds further light on two currently active versions of the malware identified as version 2 and version 3 to show how theRAThas evolved by using multiple types of defense evasion and obfuscation to avoid detection.
While both versions of the malware can be configured to communicate over HTTP, SMTP and FTP, version 3 adds theTelegramchat protocol as an option so that attackers can exfiltrate stolen data to a private Telegram chat room.
At the same time, Agent Tesla v3 also allows an attacker to decide whether or not they wish to deploy aTorclient to conceal their communications and this version of the malware can even steal the contents of the Windows system clipboard.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
As malicious spam is the most common delivery method for Agent Tesla, Sophos recommends that organizations and individuals treat email attachments fromunknown senderswith caution and verify the integrity of attachments before opening them.
After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.
Phishing attacks surge in 2024 as cybercriminals adopt AI tools and multi-channel tactics
This new phishing strategy utilizes GitHub comments to distribute malware
Do-it-yourself repair kits for the iPhone 16 series are now available from Apple
