Link to full report: IR-22-056-001_weekly056.pdf
An advanced malware operation on Discord utilizes the Babadeda crypter to hide malware that targets the crypto, NFT, and DeFi communities. Babadeda is a crypter used to encrypt and obfuscate malicious payloads in what appear to be harmless application installers or programs. Starting in May 2021, threat actors have been distributing remote access trojans obfuscated by Babadeda as a legitimate app on crypto-themed Discord channels. Due to its complex obfuscation, it has a very low AV detection
The malware seems like nothing special at first, but further exploration shows it can wreak serious damage in follow-on attacks. The NitroRansomware malware strain is changing the ransomware norm by demanding Discord Nitro gift codes from victims instead of actual money. Discord is a VoIP, instant messaging and digital-distribution platform designed for creating communities. Users communicate with voice calls, video calls, text messaging, media and files in private chats or as part of communit
