Iranian Hackers Using New PowerShell Backdoor In Cyber Espionage Attacks

 

An advanced persistent threat group with links to Iran has updated its malware toolset to include a novel PowerShell-based implant called PowerLess Backdoor, according to new research published by Cybereason.

The Boston-headquartered cybersecurity company attributed the malware to a hacking group known as Charming Kitten (aka Phosphorous, APT35, or TA453), while also calling out the backdoor's evasive PowerShell execution.

"The PowerShell code runs in the context of a .NET application, thus not launching 'powershell.exe' which enables it to evade security products," Daniel Frank, senior malware researcher at Cybereason, said. "The toolset analyzed includes extremely modular, multi-staged malware that decrypts and deploys additional payloads in several stages for the sake of both stealth and efficacy."

The threat actor, which is active since at least 2017, has been behind a series of campaigns in recent years, including those wherein the adversary posed as journalists and scholars to deceive targets into installing malware and stealing classified information.

Earlier this month, Check Point Research disclosed details of an espionage operation that involved the hacking group exploiting the Log4Shell vulnerabilities to deploy a modular backdoor dubbed CharmPower for follow-on attacks.

The latest refinements to its arsenal, as spotted by Cybereason, constitutes an entirely new toolset that encompasses the PowerLess Backdoor, which is capable of downloading and executing additional modules such as a browser info-stealer and a keylogger.

Also potentially linked to the same developer of the backdoor are a number of other malware artifacts, counting an audio recorder, an earlier variant of the information stealer, and what the researchers suspect to be an unfinished ransomware variant coded in .NET.

Furthermore, infrastructure overlaps have been identified between the Phosphorus group and a new ransomware strain called Memento, which first emerged in November 2021 and took the unusual step of locking files within password-protected archives, followed by encrypting the password and deleting the original files, after their attempts to encrypt the files directly were blocked by endpoint protection.

"The activity of Phosphorus with regard to ProxyShell took place in about the same time frame as Memento," Frank said. "Iranian threat actors were also reported to be turning to ransomware during that period, which strengthens the hypothesis that Memento is operated by an Iranian threat actor."

More info

1. Hacks And Tools
2. Hack Tools For Games
3. Pentest Tools Framework
4. Hack Tool Apk No Root
5. Hak5 Tools
6. Hacking Tools Usb
7. Physical Pentest Tools
8. Pentest Tools Url Fuzzer
9. Hacking Tools
10. Hacking Tools Pc
11. Pentest Tools Website
12. Hacker Tools For Pc
13. Best Hacking Tools 2020
14. Install Pentest Tools Ubuntu
15. Underground Hacker Sites
16. Hacking Tools For Beginners
17. Hacker Tools Mac
18. Hack Website Online Tool
19. Pentest Tools Find Subdomains
20. Pentest Tools Alternative
21. Hacking Tools And Software
22. Top Pentest Tools
23. Hacker Tools For Windows
24. Pentest Tools Subdomain
25. Hacker Techniques Tools And Incident Handling
26. Hacker Tool Kit
27. Tools Used For Hacking
28. Android Hack Tools Github
29. Hacking Tools Software
30. Hacking Tools Windows
31. Hacker Tool Kit
32. Underground Hacker Sites
33. Pentest Box Tools Download
34. Pentest Tools For Ubuntu
35. Hacking Tools For Beginners
36. Hack And Tools
37. Android Hack Tools Github
38. Hack Tools For Pc
39. Pentest Tools Website
40. Hack Tools
41. Pentest Tools For Android
42. Top Pentest Tools
43. Hack App
44. Hacking Tools
45. Hacking Tools For Kali Linux
46. Hack Tools For Games
47. Hacking Tools Software
48. Game Hacking
49. World No 1 Hacker Software
50. Hacking Tools For Kali Linux
51. Hack App
52. How To Make Hacking Tools
53. Free Pentest Tools For Windows
54. Nsa Hack Tools Download
55. Hak5 Tools
56. Hackrf Tools
57. Hacking Tools
58. Pentest Tools For Windows
59. Nsa Hack Tools Download
60. Hacker Tools Hardware
61. Pentest Tools Download
62. Hacker Tools For Mac
63. Hacker Tools
64. Pentest Box Tools Download
65. Nsa Hack Tools
66. Hack Tools For Windows
67. Pentest Tools Tcp Port Scanner
68. Kik Hack Tools
69. Hacker Tools For Ios
70. Android Hack Tools Github