Over the past year, we have also observed a significant increase in the abuse of many of these collaboration platforms to facilitate malware attacks against various organizations. We previously described how many threat actors began taking advantage of public interest in COVID-19 related information here and here. As the pandemic continued, we observed several threat actors changing their tactics, techniques and procedures to compensate for these new enterprise workflows. In many cases, these platforms provide rich environments that can be used for communication and collaboration professionally and personally. While both of these platforms have existed for some time, recent changes to employee workflows have led to an increased reliance upon them for conducting business. One major shift was the move to remote working arrangements which coincided with increased reliance on new interactive communications platforms like Discord and Slack. Communications platforms like Telegram, Signal, WhatsApp and others have been abused over the past several years to spread malware, used for command and control communications, and otherwise leveraged for nefarious purposes.Īs the COVID-19 pandemic spread across the globe in 2020, organizations made significant changes to their work routines across virtually every industry. As new platforms and applications gain in popularity, attackers often develop ways to use them to achieve their mission objectives. RATs, information stealers, internet-of-things malware and other threats are leveraging collaboration platforms for delivery, component retrieval and command and control communications.Ībuse of collaboration applications is not a new phenomenon and dates back to the early days of the internet.Collaboration platforms enable adversaries to conduct campaigns using legitimate infrastructure that may not be blocked in many network environments.

Attackers are leveraging collaboration platforms, such as Discord and Slack, to stay under the radar and evade organizational defenses.

As telework has become the norm throughout the COVID-19 pandemic, attackers are modifying their tactics to take advantage of the changes to employee workflows.

Apps like discord