UNC5174 Group’s Discord Bot Backdoor Malware

AhnLab ASEC analyzed a campaign attributed to UNC5174 that deployed a Discord bot backdoor built with the open-source discordgo Golang library to use Discord as a covert C2 channel. The malware supports remote command execution, file upload/download, and system information collection; the report documents persistence tactics (sequential backdoors), runtime-decrypted tokens/server IDs, an MD5 hash, and example indicators, and warns that using Discord greatly increases detection difficulty because malicious traffic blends with legitimate platform usage.