Transparency Myanmar

transparency.myanmar@gmail.com

Iranian Hackers Using New PowerShell Backdoor In Cyber Espionage Attacks

Posted by Transparency Myanmar 2010
Sunday, June 4, 2023

 


An advanced persistent threat group with links to Iran has updated its malware toolset to include a novel PowerShell-based implant called PowerLess Backdoor, according to new research published by Cybereason.

The Boston-headquartered cybersecurity company attributed the malware to a hacking group known as Charming Kitten (aka Phosphorous, APT35, or TA453), while also calling out the backdoor's evasive PowerShell execution.

"The PowerShell code runs in the context of a .NET application, thus not launching 'powershell.exe' which enables it to evade security products," Daniel Frank, senior malware researcher at Cybereason, said. "The toolset analyzed includes extremely modular, multi-staged malware that decrypts and deploys additional payloads in several stages for the sake of both stealth and efficacy."

The threat actor, which is active since at least 2017, has been behind a series of campaigns in recent years, including those wherein the adversary posed as journalists and scholars to deceive targets into installing malware and stealing classified information.


Earlier this month, Check Point Research disclosed details of an espionage operation that involved the hacking group exploiting the Log4Shell vulnerabilities to deploy a modular backdoor dubbed CharmPower for follow-on attacks.

The latest refinements to its arsenal, as spotted by Cybereason, constitutes an entirely new toolset that encompasses the PowerLess Backdoor, which is capable of downloading and executing additional modules such as a browser info-stealer and a keylogger.

Also potentially linked to the same developer of the backdoor are a number of other malware artifacts, counting an audio recorder, an earlier variant of the information stealer, and what the researchers suspect to be an unfinished ransomware variant coded in .NET.

Furthermore, infrastructure overlaps have been identified between the Phosphorus group and a new ransomware strain called Memento, which first emerged in November 2021 and took the unusual step of locking files within password-protected archives, followed by encrypting the password and deleting the original files, after their attempts to encrypt the files directly were blocked by endpoint protection.

"The activity of Phosphorus with regard to ProxyShell took place in about the same time frame as Memento," Frank said. "Iranian threat actors were also reported to be turning to ransomware during that period, which strengthens the hypothesis that Memento is operated by an Iranian threat actor."

Related posts
  1. Hacking Tools For Kali Linux
  2. Hacking Tools
  3. Hacking Tools
  4. Computer Hacker
  5. Blackhat Hacker Tools
  6. Hacker Tools For Ios
  7. Hacker Tools
  8. Hacking Tools Usb
  9. Top Pentest Tools
  10. Nsa Hack Tools Download
  11. Pentest Tools Github
  12. Hack Tools For Ubuntu
  13. Hacker Hardware Tools
  14. Tools 4 Hack
  15. Hacking Tools Free Download
  16. Best Pentesting Tools 2018
  17. Pentest Tools
  18. Pentest Tools Online
  19. Hacking Tools For Mac
  20. Pentest Tools
  21. Pentest Tools Subdomain
  22. Pentest Tools Tcp Port Scanner
  23. Pentest Automation Tools
  24. Hacker Search Tools
  25. Nsa Hack Tools
  26. Pentest Tools Free
  27. New Hacker Tools
  28. Hacker Tools
  29. Pentest Tools Apk
  30. Pentest Tools Open Source
  31. Hack Tools Download
  32. Hacker Tools Free Download
  33. Hacker Security Tools
  34. Github Hacking Tools
  35. Pentest Tools Apk
  36. Github Hacking Tools
  37. Best Hacking Tools 2020
  38. Pentest Tools Windows
  39. New Hack Tools
  40. Blackhat Hacker Tools
  41. Tools Used For Hacking
  42. What Is Hacking Tools
  43. Hacker Search Tools
  44. Tools 4 Hack
  45. Hacking Tools Windows 10
  46. Hack Rom Tools
  47. Pentest Tools For Android
  48. Hacker
  49. Hacking App
  50. Hacking Apps
  51. Hacking Tools For Beginners
  52. Hack Tools Download
  53. Hacker Tools Mac
  54. Pentest Tools Alternative
  55. Github Hacking Tools
  56. Pentest Tools For Ubuntu
  57. Pentest Tools Github
  58. Hacking Tools For Pc
  59. Tools Used For Hacking
  60. Nsa Hacker Tools
  61. Hacking Tools Windows 10
  62. Game Hacking
  63. New Hack Tools
  64. Kik Hack Tools
  65. Pentest Tools Tcp Port Scanner
  66. Hack Tools For Windows
  67. World No 1 Hacker Software
  68. Black Hat Hacker Tools
  69. Hak5 Tools
  70. Hacking Tools For Kali Linux
  71. Hacking Apps
  72. Hack Tools For Ubuntu
  73. Hacker Tools Free Download
  74. Computer Hacker
  75. Pentest Tools Website Vulnerability
  76. Pentest Tools Bluekeep
  77. Kik Hack Tools
  78. Tools For Hacker
  79. Nsa Hack Tools Download
  80. Pentest Tools Kali Linux

0 comments:

Post a Comment

Subscribe to: Post Comments (Atom)