<— Back

Abusing Electron-based applications in targeted attacks

Electron is a popular framework for creating pseudo-native applications with web technologies like JavaScript, HTML, and CSS. By packaging the application source codes with a particular version of Chromium (front-end part) and Node.js (back-end part), Electron allows to have just one codebase which can be run on different platforms (Windows, MacOS, and Linux).

This versatility and popularity brought attention of threat actors, as we observed several attacks against Electron-based applications, particularly supply chain ones.

In this presentation, we will look at the Electron framework (what it really is from developer’s, end-user’s, and defender’s point of view) and discuss possible infection vectors – exploiting Chromium vulnerabilities, or trojanizing the Electron applications by replacing/patching the app.asar archive (containing application sources) to embed malicious code.

Then we will follow with analyses of several real-life cases, which we recently researched, and which involved Electron-based applications. 

These include

a) a secure chat application (MiMi chat) trojanized by Iron Tiger threat actor, targeting Windows, Linux and MacOS secure chat users. Trojanized chat application becomes downloader of additional native backdoors (HyperBro for Windows, rshell for Linux and MacOS).

b) chat-based customer engagement platforms (Comm100 & LiveHelp100) trojanized by a currently unclassified threat actor. Trojanized applications download multi-stage JavaScript payload, which later downloads native multi-stage backdoor & stealer.

c) a live chat application (MeiQia) vulnerable to CVE-2021-21220, then trojanized and exploited by threat actor Water Labbu. Trojanized live chat application becomes downloader of additional malware (custom batch scripts, Cobalt Strike, or system monitoring tool). 

We will analyze not only the trojanized JavaScripts, but we will also briefly discuss the interesting native malwares too (custom backdoors, stealers, …).

At the end, we will talk about targets of these campaigns, as well as the connections to previous campaigns operated by the mentioned threat actors.