Sunday, 28 January 2024

Iranian Hackers Using New PowerShell Backdoor In Cyber Espionage Attacks

 


An advanced persistent threat group with links to Iran has updated its malware toolset to include a novel PowerShell-based implant called PowerLess Backdoor, according to new research published by Cybereason.

The Boston-headquartered cybersecurity company attributed the malware to a hacking group known as Charming Kitten (aka Phosphorous, APT35, or TA453), while also calling out the backdoor's evasive PowerShell execution.

"The PowerShell code runs in the context of a .NET application, thus not launching 'powershell.exe' which enables it to evade security products," Daniel Frank, senior malware researcher at Cybereason, said. "The toolset analyzed includes extremely modular, multi-staged malware that decrypts and deploys additional payloads in several stages for the sake of both stealth and efficacy."

The threat actor, which is active since at least 2017, has been behind a series of campaigns in recent years, including those wherein the adversary posed as journalists and scholars to deceive targets into installing malware and stealing classified information.


Earlier this month, Check Point Research disclosed details of an espionage operation that involved the hacking group exploiting the Log4Shell vulnerabilities to deploy a modular backdoor dubbed CharmPower for follow-on attacks.

The latest refinements to its arsenal, as spotted by Cybereason, constitutes an entirely new toolset that encompasses the PowerLess Backdoor, which is capable of downloading and executing additional modules such as a browser info-stealer and a keylogger.

Also potentially linked to the same developer of the backdoor are a number of other malware artifacts, counting an audio recorder, an earlier variant of the information stealer, and what the researchers suspect to be an unfinished ransomware variant coded in .NET.

Furthermore, infrastructure overlaps have been identified between the Phosphorus group and a new ransomware strain called Memento, which first emerged in November 2021 and took the unusual step of locking files within password-protected archives, followed by encrypting the password and deleting the original files, after their attempts to encrypt the files directly were blocked by endpoint protection.

"The activity of Phosphorus with regard to ProxyShell took place in about the same time frame as Memento," Frank said. "Iranian threat actors were also reported to be turning to ransomware during that period, which strengthens the hypothesis that Memento is operated by an Iranian threat actor."

Read more


  1. Hack Tools Download
  2. Hack Tools Download
  3. Termux Hacking Tools 2019
  4. How To Hack
  5. Hacker Tools Free
  6. Hacker Tools 2019
  7. New Hacker Tools
  8. Bluetooth Hacking Tools Kali
  9. Pentest Tools Url Fuzzer
  10. Pentest Tools For Ubuntu
  11. Android Hack Tools Github
  12. Pentest Tools For Android
  13. Hack Website Online Tool
  14. How To Make Hacking Tools
  15. Hacking Tools Windows
  16. Pentest Tools Subdomain
  17. Hacker Tools Online
  18. Hacker Tools Github
  19. Hacking Tools Github
  20. Pentest Tools Bluekeep
  21. Hackers Toolbox
  22. Pentest Tools Subdomain
  23. Hack Tools
  24. Hacking Tools And Software
  25. Hacking Tools Free Download
  26. Hackrf Tools
  27. Hacking Tools Online
  28. Hacking Tools For Windows 7
  29. Hacker Tools List
  30. Hacking Tools And Software
  31. Computer Hacker
  32. Easy Hack Tools
  33. Android Hack Tools Github
  34. Hacker Tool Kit
  35. Hacker Tools Linux
  36. Hacks And Tools
  37. Hacker Tools For Windows
  38. Hack Tools Mac
  39. What Are Hacking Tools
  40. Hacker Tools Free
  41. Hacker Tools For Mac
  42. Tools For Hacker
  43. Free Pentest Tools For Windows
  44. Hacking Tools Free Download
  45. Pentest Box Tools Download
  46. Nsa Hacker Tools
  47. Free Pentest Tools For Windows
  48. Kik Hack Tools
  49. Hacking Tools For Beginners
  50. Hack Tools
  51. Pentest Tools Framework
  52. Pentest Tools Open Source
  53. Pentest Tools Website Vulnerability
  54. Android Hack Tools Github
  55. Hacking Tools Github
  56. Hacker Tools Free Download
  57. Hacking App
  58. Pentest Tools Android
  59. Hack Tools For Windows
  60. Pentest Tools For Mac
  61. How To Make Hacking Tools
  62. Hacking Tools For Kali Linux
  63. New Hack Tools
  64. Pentest Tools Framework
  65. Hacking Tools
  66. Hacking Tools Windows 10
  67. Best Hacking Tools 2019
  68. Hack Tools For Games
  69. Hacker Tools For Pc
  70. Hack Tools Mac
  71. Hacking Tools Download
  72. New Hack Tools
  73. Pentest Tools Website
  74. Hacking Tools Windows 10
  75. Hack App
  76. Hacker Tools Linux
  77. Hack Tool Apk No Root
  78. Hacking Tools Github
  79. Hacker Tools For Pc
  80. Hacker Tools Windows
  81. Termux Hacking Tools 2019
  82. Pentest Tools Review
  83. Hak5 Tools
  84. Hacking Apps
  85. Nsa Hack Tools Download
  86. Pentest Tools Alternative
  87. Hacker Tools Software
  88. What Are Hacking Tools
  89. Pentest Tools Tcp Port Scanner
  90. Pentest Tools Android
  91. Pentest Automation Tools
  92. Hacker Tool Kit
  93. Tools For Hacker
  94. Hack Apps
  95. Hacking Tools Software
  96. Install Pentest Tools Ubuntu
  97. Github Hacking Tools
  98. Hacks And Tools
  99. Hackers Toolbox
  100. How To Install Pentest Tools In Ubuntu
  101. Hacker Tools Software
  102. How To Hack
  103. Hack Tools Mac
  104. Hacker Tool Kit
  105. Pentest Tools Free
  106. Pentest Tools
  107. Hack Tool Apk
  108. Hacker Hardware Tools
  109. Hacking Tools For Beginners
  110. Best Hacking Tools 2019
  111. Hacking Tools For Mac
  112. Pentest Tools Github
  113. Hacking Tools Software
  114. How To Install Pentest Tools In Ubuntu
  115. Hack Tools
  116. Hacking Tools For Beginners
  117. Hack Tools For Mac

No comments:

Post a Comment