Iranian Hackers Using New PowerShell Backdoor In Cyber Espionage Attacks

 

An advanced persistent threat group with links to Iran has updated its malware toolset to include a novel PowerShell-based implant called PowerLess Backdoor, according to new research published by Cybereason.

The Boston-headquartered cybersecurity company attributed the malware to a hacking group known as Charming Kitten (aka Phosphorous, APT35, or TA453), while also calling out the backdoor's evasive PowerShell execution.

"The PowerShell code runs in the context of a .NET application, thus not launching 'powershell.exe' which enables it to evade security products," Daniel Frank, senior malware researcher at Cybereason, said. "The toolset analyzed includes extremely modular, multi-staged malware that decrypts and deploys additional payloads in several stages for the sake of both stealth and efficacy."

The threat actor, which is active since at least 2017, has been behind a series of campaigns in recent years, including those wherein the adversary posed as journalists and scholars to deceive targets into installing malware and stealing classified information.

Earlier this month, Check Point Research disclosed details of an espionage operation that involved the hacking group exploiting the Log4Shell vulnerabilities to deploy a modular backdoor dubbed CharmPower for follow-on attacks.

The latest refinements to its arsenal, as spotted by Cybereason, constitutes an entirely new toolset that encompasses the PowerLess Backdoor, which is capable of downloading and executing additional modules such as a browser info-stealer and a keylogger.

Also potentially linked to the same developer of the backdoor are a number of other malware artifacts, counting an audio recorder, an earlier variant of the information stealer, and what the researchers suspect to be an unfinished ransomware variant coded in .NET.

Furthermore, infrastructure overlaps have been identified between the Phosphorus group and a new ransomware strain called Memento, which first emerged in November 2021 and took the unusual step of locking files within password-protected archives, followed by encrypting the password and deleting the original files, after their attempts to encrypt the files directly were blocked by endpoint protection.

"The activity of Phosphorus with regard to ProxyShell took place in about the same time frame as Memento," Frank said. "Iranian threat actors were also reported to be turning to ransomware during that period, which strengthens the hypothesis that Memento is operated by an Iranian threat actor."

Related links

1. Hacker Tools Software
2. Pentest Box Tools Download
3. Pentest Tools Android
4. Hacker Tools Mac
5. Hacking Tools Free Download
6. Hacking Tools Name
7. Pentest Tools Bluekeep
8. Hack Website Online Tool
9. Hack Tools
10. Pentest Tools For Ubuntu
11. Hacker Techniques Tools And Incident Handling
12. New Hack Tools
13. Hacking Tools For Mac
14. Pentest Tools Android
15. Tools Used For Hacking
16. Hacking Tools Kit
17. Pentest Tools Bluekeep
18. Easy Hack Tools
19. Hacker Tools Free
20. Hacker Tools For Mac
21. Hacker Tools Mac
22. Hack And Tools
23. Hacking Tools Software
24. Pentest Tools Review
25. Hacker Tools
26. Pentest Tools Find Subdomains
27. Pentest Tools Tcp Port Scanner
28. Hacking Tools Windows
29. Tools 4 Hack
30. Nsa Hacker Tools
31. Pentest Tools Alternative
32. Hacking Tools For Mac
33. Pentest Tools Url Fuzzer
34. What Is Hacking Tools
35. Termux Hacking Tools 2019
36. Hack Tools Github
37. Hacker Tools 2020
38. Hack Tools Pc
39. Hacker Tools Mac
40. Hack App
41. Top Pentest Tools
42. Pentest Tools Online
43. Hacker Tools Windows
44. Hack Tool Apk No Root
45. Hack Tools
46. Hacking Tools Hardware
47. Hacker Tools Linux
48. Hacker Search Tools
49. Nsa Hacker Tools
50. Hacking Tools For Games
51. Hacker Tools For Windows
52. Pentest Tools Subdomain
53. Pentest Tools Framework
54. Termux Hacking Tools 2019
55. Hacking Tools Windows
56. Pentest Tools Review
57. Pentest Tools Apk