An advanced persistent threat group with links to Iran has updated its malware toolset to include a novel PowerShell-based implant called PowerLess Backdoor, according to new research published by Cybereason.
The Boston-headquartered cybersecurity company attributed the malware to a hacking group known as Charming Kitten (aka Phosphorous, APT35, or TA453), while also calling out the backdoor's evasive PowerShell execution.
"The PowerShell code runs in the context of a .NET application, thus not launching 'powershell.exe' which enables it to evade security products," Daniel Frank, senior malware researcher at Cybereason, said. "The toolset analyzed includes extremely modular, multi-staged malware that decrypts and deploys additional payloads in several stages for the sake of both stealth and efficacy."
The threat actor, which is active since at least 2017, has been behind a series of campaigns in recent years, including those wherein the adversary posed as journalists and scholars to deceive targets into installing malware and stealing classified information.
Earlier this month, Check Point Research disclosed details of an espionage operation that involved the hacking group exploiting the Log4Shell vulnerabilities to deploy a modular backdoor dubbed CharmPower for follow-on attacks.
The latest refinements to its arsenal, as spotted by Cybereason, constitutes an entirely new toolset that encompasses the PowerLess Backdoor, which is capable of downloading and executing additional modules such as a browser info-stealer and a keylogger.
Also potentially linked to the same developer of the backdoor are a number of other malware artifacts, counting an audio recorder, an earlier variant of the information stealer, and what the researchers suspect to be an unfinished ransomware variant coded in .NET.
Furthermore, infrastructure overlaps have been identified between the Phosphorus group and a new ransomware strain called Memento, which first emerged in November 2021 and took the unusual step of locking files within password-protected archives, followed by encrypting the password and deleting the original files, after their attempts to encrypt the files directly were blocked by endpoint protection.
"The activity of Phosphorus with regard to ProxyShell took place in about the same time frame as Memento," Frank said. "Iranian threat actors were also reported to be turning to ransomware during that period, which strengthens the hypothesis that Memento is operated by an Iranian threat actor."
Related word
- Pentest Tools Github
- Hacking Tools Windows
- How To Hack
- Hackrf Tools
- Pentest Tools Subdomain
- Hacker Tools Linux
- Termux Hacking Tools 2019
- Hacking Tools For Games
- Pentest Tools Android
- Hacking App
- Hack Tool Apk
- Pentest Tools Windows
- Tools For Hacker
- Pentest Tools For Windows
- Hacking Tools For Mac
- Hacking Apps
- Underground Hacker Sites
- Hacker Hardware Tools
- Pentest Tools Website
- Hacker Tools Hardware
- Hacker Search Tools
- Wifi Hacker Tools For Windows
- Hacking Tools Windows
- Pentest Tools Android
- Hacker Tools Online
- Termux Hacking Tools 2019
- Hacking Tools 2019
- Pentest Tools Open Source
- Hack Tools Download
- Pentest Tools List
- Hacker Tools Free
- Underground Hacker Sites
- Pentest Tools List
- Hack Tools
- Hacking Tools For Pc
- Best Hacking Tools 2020
- Hacker Security Tools
- Pentest Automation Tools
- Beginner Hacker Tools
- Easy Hack Tools
- World No 1 Hacker Software
- Hack Website Online Tool
- Hacking Tools 2020
- Hackers Toolbox
- Hacker Tools For Windows
- Hack Tools
- Hacking Tools
- Ethical Hacker Tools
- Pentest Tools List
- Hack Website Online Tool
- Pentest Tools Windows
- Game Hacking
- Hacker Tools Software
- Pentest Tools Open Source
- Pentest Tools Android
- Github Hacking Tools
- Hacking Tools For Windows
- Hacker Tools
- Pentest Automation Tools
- Pentest Reporting Tools
- Hacker Tools
- Hak5 Tools
- Hacking Tools For Beginners
- Pentest Tools Online
- Hacker Tools For Ios
- Pentest Tools Linux
- Hack Tools For Pc
- Hacker Techniques Tools And Incident Handling
- Hacking Tools For Mac
- Best Pentesting Tools 2018
- Pentest Tools Online
- Hacking Tools Kit
- How To Hack
- Hacker Tools Apk Download
- Hacking Apps
- Computer Hacker
- Pentest Tools Website Vulnerability
- Hacking Tools Github
- Easy Hack Tools
- Best Pentesting Tools 2018
- Hacking Tools For Windows
- Hacking Tools Mac
- Hacking Tools And Software
- Hacker Tools List
- Tools 4 Hack
- Hacker Tools 2019
- Hack Tools For Games
- Pentest Tools Subdomain
- Pentest Tools Framework
- Hacker Search Tools
- Best Hacking Tools 2020
- Beginner Hacker Tools
- Pentest Tools Framework
- What Are Hacking Tools
- Hack Tool Apk No Root
- Hacker Tools Software
- How To Hack
- Hack And Tools
- Ethical Hacker Tools
- Pentest Tools Port Scanner
- Pentest Tools Windows
- Hacking Tools Online
- Pentest Box Tools Download
- Hack And Tools
- Physical Pentest Tools
- Hacking Tools Hardware
- Tools For Hacker
- Pentest Tools For Windows
- Hack Tools For Pc
- Pentest Tools Url Fuzzer
- World No 1 Hacker Software
- Hacking Tools Github
- Hacking Tools Pc
- Pentest Tools Port Scanner
- Hacking Tools For Kali Linux
- Pentest Tools For Ubuntu
- Hacker Security Tools
- Hacking Tools Github
- Hacker Tools Apk
- Growth Hacker Tools
- Hacking Tools For Windows 7
- Hacking Tools Windows
- Best Hacking Tools 2019
- Pentest Tools Website Vulnerability
- Pentest Tools For Windows
- Pentest Tools Framework
- Hack Tools
- Tools For Hacker
- Hack Tools Pc
- Hacker Tools Linux
- Hack Apps
- Hack And Tools
- Pentest Tools Android
- Hacking Tools For Windows 7
- Hacker Tools 2019
- Hacking Tools For Windows
- Hacking Tools For Kali Linux
- Hack Website Online Tool
- Hacking Tools Windows
- Top Pentest Tools
- Best Hacking Tools 2019
- Termux Hacking Tools 2019
- Pentest Tools Github
- Pentest Recon Tools
- Hack Rom Tools
- Hacking Tools 2020
- Hacker Tools For Windows
- Blackhat Hacker Tools
- Pentest Tools Nmap
- Bluetooth Hacking Tools Kali
- Pentest Tools Port Scanner
- Hacking Tools For Beginners
- Pentest Tools For Ubuntu
- Hacking Tools For Kali Linux
- Hack Tools Github
- Pentest Tools Framework
- Tools For Hacker
- Bluetooth Hacking Tools Kali
- Hacking Tools 2020
- Nsa Hack Tools
- Hack Tools Online
- Black Hat Hacker Tools
No comments:
Post a Comment