LevelBlue Shows How Backdoored Electron Apps Can Evade Defenses
Summary
LevelBlue GSOC demonstrates how modifying Electron app files can deliver a Meterpreter payload for persistence or hollow Microsoft Teams to run Loki C2 despite WDAC. The report details detection indicators and defensive measures.
Key points
- The report demonstrates inserting JavaScript into GitHub Desktop’s main.js or Microsoft Teams’ app.asar to download and launch a Meterpreter payload that persists after the Electron app exits.
- In a separate demonstration, replacing Teams resources with a Loki C2 agent allowed it to run under the trusted, WDAC-safelisted application; the original Teams app stopped working.
- The analysis identifies potential Loki indicators including connections to Azure Blob Storage subdomains (*.blob.core[.]windows[.]net), an unusual --user-data-dir path, and deletion of application files by an unrelated process.
- For backdoored apps, suggested detection signals include unexpected child processes, JavaScript file modifications, unexpected network connections and network scanning.
- LevelBlue recommends installing Electron apps in non-user-writable directories, cataloging expected applications and behavior, establishing baselines, and enabling file-event monitoring.
- The report says APT27 was documented by researchers as having backdoored the Electron app Mimi Chat in 2021–2022, gaining a foothold on Windows and macOS targets.
Article Details
- Attack Vectors
- Backdoor an installed Electron application by modifying files such as main.js or app.asar to download and execute a Meterpreter payload.
- Replace the resources of a WDAC-safelisted Microsoft Teams installation with a Loki C2 agent, allowing the agent to run under the trusted Electron application.
- The article reports that APT27 was documented as backdooring Mimi Chat during 2021–2022 to compromise Windows and macOS targets.
- Defensive Notes
- Install Electron applications in non-user-writable directories and do not rely on application safelisting alone.
- Baseline expected application behavior and monitor for unrelated processes modifying Electron JavaScript files or deleting application resources.
- Investigate unexpected child processes, network scanning, unusual external connections, and Electron processes using a --user-data-dir path under AppData\Roaming.
- Enable file event monitoring and catalog the Electron applications expected in the environment.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 10[.]0[.]5[.]3 | Attacker-controlled Linux host in the report's demonstration; served the staged Meterpreter payload and received the reverse-shell C2 connection. |
MITRE ATT&CK
T1036 · MasqueradingMalicious functionality runs through trusted application names, including Microsoft Teams and GitHub Desktop, to evade scrutiny.T1059.007 · JavaScriptJavaScript inserted into Electron files such as main.js and main.bundle.js downloads and launches a payload.T1105 · Ingress Tool TransferThe backdoored application downloads the Meterpreter payload from the attacker-controlled host.T1218.015 · Electron ApplicationsThe demonstrations abuse trusted Electron applications, including GitHub Desktop and Microsoft Teams, to execute malicious code and bypass application safelisting.
People
Threat Actors
Vendors
LevelBlueLevelBlue’s GSOC shows how trusted Electron apps can be abused for persistence and to bypass application safelisting by backdooring or hollowing out applications like GitHub Desktop and Microsoft Teams.MicrosoftLevelBlue’s GSOC shows how trusted Electron apps can be abused for persistence and to bypass application safelisting by backdooring or hollowing out applications like GitHub Desktop and Microsoft Teams.
Products
GitHub DesktopLevelBlue’s GSOC shows how trusted Electron apps can be abused for persistence and to bypass application safelisting by backdooring or hollowing out applications like GitHub Desktop and Microsoft Teams.Microsoft TeamsLevelBlue’s GSOC shows how trusted Electron apps can be abused for persistence and to bypass application safelisting by backdooring or hollowing out applications like GitHub Desktop and Microsoft Teams.Mimi ChatThe report also demonstrates detection guidance for Loki C2 activity and highlights APT27-linked abuse of Electron applications such as Mimi Chat.WDACTeams can be hollowed out and replaced with Loki C2 agent code to bypass WDAC application safelisting controls.Windows 10In our first scenario, we already have a foothold on an internal Windows 10 host but would like to now add persistence to this access.
Tools
LokiThe report also demonstrates detection guidance for Loki C2 activity and highlights APT27-linked abuse of Electron applications such as Mimi Chat.MeterpreterThe report demonstrates persistence by downloading and executing a Meterpreter payload from a backdoored GitHub Desktop or Teams installation.