An advanced persistent threat group with links to Iran has updated its malware toolset to include a novel PowerShell-based implant called PowerLess Backdoor, according to new research published by Cybereason.
The Boston-headquartered cybersecurity company attributed the malware to a hacking group known as Charming Kitten (aka Phosphorous, APT35, or TA453), while also calling out the backdoor's evasive PowerShell execution.
"The PowerShell code runs in the context of a .NET application, thus not launching 'powershell.exe' which enables it to evade security products," Daniel Frank, senior malware researcher at Cybereason, said. "The toolset analyzed includes extremely modular, multi-staged malware that decrypts and deploys additional payloads in several stages for the sake of both stealth and efficacy."
The threat actor, which is active since at least 2017, has been behind a series of campaigns in recent years, including those wherein the adversary posed as journalists and scholars to deceive targets into installing malware and stealing classified information.
Earlier this month, Check Point Research disclosed details of an espionage operation that involved the hacking group exploiting the Log4Shell vulnerabilities to deploy a modular backdoor dubbed CharmPower for follow-on attacks.
The latest refinements to its arsenal, as spotted by Cybereason, constitutes an entirely new toolset that encompasses the PowerLess Backdoor, which is capable of downloading and executing additional modules such as a browser info-stealer and a keylogger.
Also potentially linked to the same developer of the backdoor are a number of other malware artifacts, counting an audio recorder, an earlier variant of the information stealer, and what the researchers suspect to be an unfinished ransomware variant coded in .NET.
Furthermore, infrastructure overlaps have been identified between the Phosphorus group and a new ransomware strain called Memento, which first emerged in November 2021 and took the unusual step of locking files within password-protected archives, followed by encrypting the password and deleting the original files, after their attempts to encrypt the files directly were blocked by endpoint protection.
"The activity of Phosphorus with regard to ProxyShell took place in about the same time frame as Memento," Frank said. "Iranian threat actors were also reported to be turning to ransomware during that period, which strengthens the hypothesis that Memento is operated by an Iranian threat actor."
Read more
- Hack Tools Download
- Hack Tools Download
- Termux Hacking Tools 2019
- How To Hack
- Hacker Tools Free
- Hacker Tools 2019
- New Hacker Tools
- Bluetooth Hacking Tools Kali
- Pentest Tools Url Fuzzer
- Pentest Tools For Ubuntu
- Android Hack Tools Github
- Pentest Tools For Android
- Hack Website Online Tool
- How To Make Hacking Tools
- Hacking Tools Windows
- Pentest Tools Subdomain
- Hacker Tools Online
- Hacker Tools Github
- Hacking Tools Github
- Pentest Tools Bluekeep
- Hackers Toolbox
- Pentest Tools Subdomain
- Hack Tools
- Hacking Tools And Software
- Hacking Tools Free Download
- Hackrf Tools
- Hacking Tools Online
- Hacking Tools For Windows 7
- Hacker Tools List
- Hacking Tools And Software
- Computer Hacker
- Easy Hack Tools
- Android Hack Tools Github
- Hacker Tool Kit
- Hacker Tools Linux
- Hacks And Tools
- Hacker Tools For Windows
- Hack Tools Mac
- What Are Hacking Tools
- Hacker Tools Free
- Hacker Tools For Mac
- Tools For Hacker
- Free Pentest Tools For Windows
- Hacking Tools Free Download
- Pentest Box Tools Download
- Nsa Hacker Tools
- Free Pentest Tools For Windows
- Kik Hack Tools
- Hacking Tools For Beginners
- Hack Tools
- Pentest Tools Framework
- Pentest Tools Open Source
- Pentest Tools Website Vulnerability
- Android Hack Tools Github
- Hacking Tools Github
- Hacker Tools Free Download
- Hacking App
- Pentest Tools Android
- Hack Tools For Windows
- Pentest Tools For Mac
- How To Make Hacking Tools
- Hacking Tools For Kali Linux
- New Hack Tools
- Pentest Tools Framework
- Hacking Tools
- Hacking Tools Windows 10
- Best Hacking Tools 2019
- Hack Tools For Games
- Hacker Tools For Pc
- Hack Tools Mac
- Hacking Tools Download
- New Hack Tools
- Pentest Tools Website
- Hacking Tools Windows 10
- Hack App
- Hacker Tools Linux
- Hack Tool Apk No Root
- Hacking Tools Github
- Hacker Tools For Pc
- Hacker Tools Windows
- Termux Hacking Tools 2019
- Pentest Tools Review
- Hak5 Tools
- Hacking Apps
- Nsa Hack Tools Download
- Pentest Tools Alternative
- Hacker Tools Software
- What Are Hacking Tools
- Pentest Tools Tcp Port Scanner
- Pentest Tools Android
- Pentest Automation Tools
- Hacker Tool Kit
- Tools For Hacker
- Hack Apps
- Hacking Tools Software
- Install Pentest Tools Ubuntu
- Github Hacking Tools
- Hacks And Tools
- Hackers Toolbox
- How To Install Pentest Tools In Ubuntu
- Hacker Tools Software
- How To Hack
- Hack Tools Mac
- Hacker Tool Kit
- Pentest Tools Free
- Pentest Tools
- Hack Tool Apk
- Hacker Hardware Tools
- Hacking Tools For Beginners
- Best Hacking Tools 2019
- Hacking Tools For Mac
- Pentest Tools Github
- Hacking Tools Software
- How To Install Pentest Tools In Ubuntu
- Hack Tools
- Hacking Tools For Beginners
- Hack Tools For Mac
No comments:
Post a Comment