An advanced persistent threat group with links to Iran has updated its malware toolset to include a novel PowerShell-based implant called PowerLess Backdoor, according to new research published by Cybereason.
The Boston-headquartered cybersecurity company attributed the malware to a hacking group known as Charming Kitten (aka Phosphorous, APT35, or TA453), while also calling out the backdoor's evasive PowerShell execution.
"The PowerShell code runs in the context of a .NET application, thus not launching 'powershell.exe' which enables it to evade security products," Daniel Frank, senior malware researcher at Cybereason, said. "The toolset analyzed includes extremely modular, multi-staged malware that decrypts and deploys additional payloads in several stages for the sake of both stealth and efficacy."
The threat actor, which is active since at least 2017, has been behind a series of campaigns in recent years, including those wherein the adversary posed as journalists and scholars to deceive targets into installing malware and stealing classified information.
Earlier this month, Check Point Research disclosed details of an espionage operation that involved the hacking group exploiting the Log4Shell vulnerabilities to deploy a modular backdoor dubbed CharmPower for follow-on attacks.
The latest refinements to its arsenal, as spotted by Cybereason, constitutes an entirely new toolset that encompasses the PowerLess Backdoor, which is capable of downloading and executing additional modules such as a browser info-stealer and a keylogger.
Also potentially linked to the same developer of the backdoor are a number of other malware artifacts, counting an audio recorder, an earlier variant of the information stealer, and what the researchers suspect to be an unfinished ransomware variant coded in .NET.
Furthermore, infrastructure overlaps have been identified between the Phosphorus group and a new ransomware strain called Memento, which first emerged in November 2021 and took the unusual step of locking files within password-protected archives, followed by encrypting the password and deleting the original files, after their attempts to encrypt the files directly were blocked by endpoint protection.
"The activity of Phosphorus with regard to ProxyShell took place in about the same time frame as Memento," Frank said. "Iranian threat actors were also reported to be turning to ransomware during that period, which strengthens the hypothesis that Memento is operated by an Iranian threat actor."
Related word
- Tools 4 Hack
- Hack Apps
- Hack Apps
- Hacker Tool Kit
- Hacker Hardware Tools
- New Hack Tools
- How To Hack
- Pentest Tools Linux
- Android Hack Tools Github
- Hack Tools Pc
- Hack Tools Mac
- Hacker Techniques Tools And Incident Handling
- Easy Hack Tools
- What Are Hacking Tools
- Hacker Tools For Ios
- Hacker Tools Windows
- Hack Rom Tools
- Hack Website Online Tool
- Github Hacking Tools
- Hacking Tools Pc
- Hacks And Tools
- Tools 4 Hack
- Hacker Tools For Windows
- Pentest Tools Github
- Hack Tools For Windows
- Hacking Tools Hardware
- Pentest Tools Website
- Hacking Tools Free Download
- Hacking Tools Name
- Pentest Tools Review
- Hack Tool Apk No Root
- Hacker Tools Online
- Hacker Tools List
- Hack Tools Online
- Hacker Tools Online
- Pentest Tools Find Subdomains
- Hacking Tools Name
- Hack Tools
- Pentest Tools
- Growth Hacker Tools
- Hack Tools Mac
- Hacking Tools For Windows Free Download
- New Hack Tools
- Hack Tools
- Hacker Tools Free
- Hacker Tools Free
- Pentest Tools Website Vulnerability
- Hacking Tools Mac
- Hacker Tools Mac
- Hacking Tools Kit
- Hack And Tools
- Hak5 Tools
- Pentest Tools Github
- New Hacker Tools
- Hack Tools For Windows
- Blackhat Hacker Tools
- Hack Tools For Games
- Pentest Tools Open Source
- Hack Tools Download
- Hack Tool Apk No Root
- Pentest Tools For Ubuntu
- Black Hat Hacker Tools
- Hacker Tools 2019
- Game Hacking
- Hacking Tools For Windows 7
- Hacker Tools
- Pentest Reporting Tools
- Pentest Tools For Ubuntu
- Hacker Search Tools
- Hacker Tools 2019
- Hack Tool Apk No Root
- Hacking Tools
- Hack And Tools
- Hacking Tools For Mac
- Hacker Tool Kit
- Game Hacking
- Hacking Tools For Mac
- How To Hack
- Pentest Recon Tools
- Hack Tools Pc
- Easy Hack Tools
- Hack Tools Online
- Pentest Tools Alternative
- Hack Tools Mac
- Hack Tools
- Hack Tool Apk
- Pentest Tools Bluekeep
- Hacker Tools For Ios
- Hacker Tools For Windows
- Hacking Tools For Kali Linux
- Beginner Hacker Tools
- Hacker Security Tools
- Hacker Tools Github
- Hacker Techniques Tools And Incident Handling
- Termux Hacking Tools 2019
- How To Install Pentest Tools In Ubuntu
- Hacking Apps
- Pentest Tools Free
- Pentest Tools Nmap
- Best Hacking Tools 2020
- Hacking Tools For Beginners
- Hacker
- Tools 4 Hack
- Hacker Tools Mac
No comments:
Post a Comment