An advanced persistent threat group with links to Iran has updated its malware toolset to include a novel PowerShell-based implant called PowerLess Backdoor, according to new research published by Cybereason.
The Boston-headquartered cybersecurity company attributed the malware to a hacking group known as Charming Kitten (aka Phosphorous, APT35, or TA453), while also calling out the backdoor's evasive PowerShell execution.
"The PowerShell code runs in the context of a .NET application, thus not launching 'powershell.exe' which enables it to evade security products," Daniel Frank, senior malware researcher at Cybereason, said. "The toolset analyzed includes extremely modular, multi-staged malware that decrypts and deploys additional payloads in several stages for the sake of both stealth and efficacy."
The threat actor, which is active since at least 2017, has been behind a series of campaigns in recent years, including those wherein the adversary posed as journalists and scholars to deceive targets into installing malware and stealing classified information.
Earlier this month, Check Point Research disclosed details of an espionage operation that involved the hacking group exploiting the Log4Shell vulnerabilities to deploy a modular backdoor dubbed CharmPower for follow-on attacks.
The latest refinements to its arsenal, as spotted by Cybereason, constitutes an entirely new toolset that encompasses the PowerLess Backdoor, which is capable of downloading and executing additional modules such as a browser info-stealer and a keylogger.
Also potentially linked to the same developer of the backdoor are a number of other malware artifacts, counting an audio recorder, an earlier variant of the information stealer, and what the researchers suspect to be an unfinished ransomware variant coded in .NET.
Furthermore, infrastructure overlaps have been identified between the Phosphorus group and a new ransomware strain called Memento, which first emerged in November 2021 and took the unusual step of locking files within password-protected archives, followed by encrypting the password and deleting the original files, after their attempts to encrypt the files directly were blocked by endpoint protection.
"The activity of Phosphorus with regard to ProxyShell took place in about the same time frame as Memento," Frank said. "Iranian threat actors were also reported to be turning to ransomware during that period, which strengthens the hypothesis that Memento is operated by an Iranian threat actor."
Related word
- Hack Tools
- Computer Hacker
- Hacking App
- Hackers Toolbox
- Hack Tool Apk No Root
- Hack Apps
- Tools Used For Hacking
- What Are Hacking Tools
- Pentest Tools Linux
- Pentest Tools Free
- Hacking Tools Download
- Pentest Tools Find Subdomains
- Pentest Tools Github
- What Are Hacking Tools
- Hacking Tools Free Download
- Hacking Tools 2020
- Hack Tools
- Nsa Hack Tools
- Kik Hack Tools
- How To Install Pentest Tools In Ubuntu
- Nsa Hack Tools
- Hack Tools 2019
- Hacking App
- How To Make Hacking Tools
- Usb Pentest Tools
- Pentest Tools For Mac
- Hacking Tools Windows
- Termux Hacking Tools 2019
- Hacking Tools 2019
- New Hacker Tools
- Hacker Tools List
- Hack Tool Apk
- Pentest Tools Tcp Port Scanner
- Hack Apps
- Pentest Tools Github
- Best Pentesting Tools 2018
- Hacker
- Hacker Tools Apk Download
- Hacking Tools For Windows Free Download
- Hacker Tools Mac
- Pentest Tools For Android
- Pentest Box Tools Download
- Computer Hacker
- Black Hat Hacker Tools
- Game Hacking
- Pentest Tools Tcp Port Scanner
- Hacker Tools List
- Hack Tools Github
- Tools 4 Hack
- Hacking Tools Github
- Hack Tools Download
- Beginner Hacker Tools
- Pentest Tools Framework
- Pentest Tools Apk
- Pentest Tools Github
- Hacker Tools Github
- Hacker Tools Apk
- Pentest Tools Android
- Pentest Tools For Ubuntu
- Bluetooth Hacking Tools Kali
- Hacker Tools For Windows
- Pentest Tools Find Subdomains
- Pentest Tools Bluekeep
- Hack And Tools
- Pentest Tools Url Fuzzer
- Hack Tools For Windows
- Easy Hack Tools
- Pentest Tools Linux
- Physical Pentest Tools
- Hacker Tools For Windows
- Hacking Tools Usb
- Hacking Tools Windows
- What Are Hacking Tools
- Hacking Tools 2020
- Hak5 Tools
- Hacking Tools
- Hackers Toolbox
- Hacking Tools And Software
- Nsa Hack Tools Download
- Hacks And Tools
- Pentest Tools Website
- Pentest Tools Online
- How To Hack
- Ethical Hacker Tools
- Hacker Hardware Tools
- Hacking Tools For Games
- Hack Apps
- Pentest Tools Website Vulnerability
- Hacker Search Tools
- Tools 4 Hack
- Pentest Tools
- Hacking Tools Online
- Tools 4 Hack
- Pentest Box Tools Download
- Hack And Tools
- Pentest Tools Port Scanner
- Pentest Tools Tcp Port Scanner
- Pentest Tools Review
- Hack Tools Pc
- Hacker Tools Free
- Hack Tools Github
- Hack Tools Pc
- Hacking Tools For Kali Linux
- Free Pentest Tools For Windows
- Hacking Tools Download
- Hack Tools For Games
- Hack And Tools
- Tools 4 Hack
- Pentest Recon Tools
- Hacking Tools Windows
- Hacker Tools Windows
- Hacking Tools Hardware
- Pentest Tools Nmap
- Wifi Hacker Tools For Windows
- Hack Tools Mac
- Hack Tools Pc
- Hacker Tools Apk Download
- How To Install Pentest Tools In Ubuntu
- Pentest Reporting Tools
- Hacker Tools Linux
- Hackrf Tools
- Hacking Tools Name
- New Hack Tools
- Hack Tools For Mac
- Android Hack Tools Github
- Pentest Tools Url Fuzzer
- What Are Hacking Tools
- Hacker Tools For Windows
- Hacker Tools Online
- Hack Tool Apk No Root
- Hacker Tools Hardware
- Hack Tools Download
- Hackers Toolbox
- Pentest Tools Website Vulnerability
- Game Hacking
- Kik Hack Tools
No comments:
Post a Comment