Iranian Hackers Using New PowerShell Backdoor In Cyber Espionage Attacks

 

An advanced persistent threat group with links to Iran has updated its malware toolset to include a novel PowerShell-based implant called PowerLess Backdoor, according to new research published by Cybereason.

The Boston-headquartered cybersecurity company attributed the malware to a hacking group known as Charming Kitten (aka Phosphorous, APT35, or TA453), while also calling out the backdoor's evasive PowerShell execution.

"The PowerShell code runs in the context of a .NET application, thus not launching 'powershell.exe' which enables it to evade security products," Daniel Frank, senior malware researcher at Cybereason, said. "The toolset analyzed includes extremely modular, multi-staged malware that decrypts and deploys additional payloads in several stages for the sake of both stealth and efficacy."

The threat actor, which is active since at least 2017, has been behind a series of campaigns in recent years, including those wherein the adversary posed as journalists and scholars to deceive targets into installing malware and stealing classified information.

Earlier this month, Check Point Research disclosed details of an espionage operation that involved the hacking group exploiting the Log4Shell vulnerabilities to deploy a modular backdoor dubbed CharmPower for follow-on attacks.

The latest refinements to its arsenal, as spotted by Cybereason, constitutes an entirely new toolset that encompasses the PowerLess Backdoor, which is capable of downloading and executing additional modules such as a browser info-stealer and a keylogger.

Also potentially linked to the same developer of the backdoor are a number of other malware artifacts, counting an audio recorder, an earlier variant of the information stealer, and what the researchers suspect to be an unfinished ransomware variant coded in .NET.

Furthermore, infrastructure overlaps have been identified between the Phosphorus group and a new ransomware strain called Memento, which first emerged in November 2021 and took the unusual step of locking files within password-protected archives, followed by encrypting the password and deleting the original files, after their attempts to encrypt the files directly were blocked by endpoint protection.

"The activity of Phosphorus with regard to ProxyShell took place in about the same time frame as Memento," Frank said. "Iranian threat actors were also reported to be turning to ransomware during that period, which strengthens the hypothesis that Memento is operated by an Iranian threat actor."

More info

1. Hacker Tools List
2. Ethical Hacker Tools
3. Usb Pentest Tools
4. Pentest Tools Open Source
5. Hacker Tools Mac
6. Nsa Hack Tools
7. Pentest Tools Linux
8. Hacker Techniques Tools And Incident Handling
9. Pentest Recon Tools
10. Hacking Tools For Windows 7
11. Best Hacking Tools 2020
12. Hacking Tools For Beginners
13. Hacker Tools Apk Download
14. Hacking Tools Windows
15. Pentest Automation Tools
16. Pentest Tools Website
17. Hacker Tools
18. Hacking Tools Hardware
19. Top Pentest Tools
20. Pentest Tools Linux
21. Pentest Tools Website Vulnerability
22. Hack Tools For Ubuntu
23. Hacking Tools And Software
24. Easy Hack Tools
25. Pentest Tools Linux
26. Hack Tools
27. Hack Tools For Games
28. Hacker Tools Free
29. Hacker Tools Apk Download
30. Hack Tools For Windows
31. World No 1 Hacker Software
32. Black Hat Hacker Tools
33. Hacker Tools Windows
34. Hacker Tools Hardware
35. Ethical Hacker Tools
36. Hacking Tools For Games
37. Physical Pentest Tools
38. Hacking Tools For Games
39. New Hacker Tools
40. Pentest Tools Online
41. Hack Tools For Games
42. Hacker Tools 2020
43. Hacking Tools 2020
44. Pentest Tools Review
45. Hack Tools Download
46. Hacking Tools For Pc
47. Hacker Tools For Windows
48. Pentest Tools For Ubuntu
49. Hacker Tools 2019
50. Hack Apps
51. Pentest Tools Apk
52. Hacker Tools 2020
53. Kik Hack Tools
54. Hacking Tools For Windows
55. Termux Hacking Tools 2019
56. Hacking Tools For Pc
57. Hacker Tools For Pc
58. Hacking Tools For Beginners
59. Pentest Tools Review
60. Hacker Tools Apk Download
61. Pentest Tools For Mac
62. Game Hacking
63. Hackers Toolbox
64. What Are Hacking Tools
65. Best Hacking Tools 2020
66. Tools For Hacker
67. Hacker Tools For Mac
68. World No 1 Hacker Software
69. Usb Pentest Tools
70. Hack Tools