An advanced persistent threat group with links to Iran has updated its malware toolset to include a novel PowerShell-based implant called PowerLess Backdoor, according to new research published by Cybereason.
The Boston-headquartered cybersecurity company attributed the malware to a hacking group known as Charming Kitten (aka Phosphorous, APT35, or TA453), while also calling out the backdoor's evasive PowerShell execution.
"The PowerShell code runs in the context of a .NET application, thus not launching 'powershell.exe' which enables it to evade security products," Daniel Frank, senior malware researcher at Cybereason, said. "The toolset analyzed includes extremely modular, multi-staged malware that decrypts and deploys additional payloads in several stages for the sake of both stealth and efficacy."
The threat actor, which is active since at least 2017, has been behind a series of campaigns in recent years, including those wherein the adversary posed as journalists and scholars to deceive targets into installing malware and stealing classified information.
Earlier this month, Check Point Research disclosed details of an espionage operation that involved the hacking group exploiting the Log4Shell vulnerabilities to deploy a modular backdoor dubbed CharmPower for follow-on attacks.
The latest refinements to its arsenal, as spotted by Cybereason, constitutes an entirely new toolset that encompasses the PowerLess Backdoor, which is capable of downloading and executing additional modules such as a browser info-stealer and a keylogger.
Also potentially linked to the same developer of the backdoor are a number of other malware artifacts, counting an audio recorder, an earlier variant of the information stealer, and what the researchers suspect to be an unfinished ransomware variant coded in .NET.
Furthermore, infrastructure overlaps have been identified between the Phosphorus group and a new ransomware strain called Memento, which first emerged in November 2021 and took the unusual step of locking files within password-protected archives, followed by encrypting the password and deleting the original files, after their attempts to encrypt the files directly were blocked by endpoint protection.
"The activity of Phosphorus with regard to ProxyShell took place in about the same time frame as Memento," Frank said. "Iranian threat actors were also reported to be turning to ransomware during that period, which strengthens the hypothesis that Memento is operated by an Iranian threat actor."
Related news
- Best Hacking Tools 2019
- Hacker Techniques Tools And Incident Handling
- Hack Tools Mac
- Hacker
- Kik Hack Tools
- Hack Tools
- Install Pentest Tools Ubuntu
- Hack Tool Apk No Root
- Pentest Tools Review
- Termux Hacking Tools 2019
- Hacker Tools Online
- Hacking Tools Download
- Hacking App
- Pentest Tools Port Scanner
- What Are Hacking Tools
- Hacker Tools Mac
- Pentest Box Tools Download
- Hacker Tools For Windows
- Hacking Tools Online
- Hack Tools Download
- Pentest Tools Linux
- Computer Hacker
- Hack Rom Tools
- Hacking Tools Mac
- Pentest Tools For Windows
- Pentest Tools Bluekeep
- Pentest Tools Download
- Hacker Tools For Windows
- Hacking Tools And Software
- Tools Used For Hacking
- Hack Tools For Windows
- Hack App
- Install Pentest Tools Ubuntu
- What Is Hacking Tools
- Hackrf Tools
- Hacking Tools Mac
- Hack Tools Pc
- Hackrf Tools
- Hacker Tools
- Hacking Tools For Windows
- Hacking Tools Pc
- Hacking Tools Free Download
- Pentest Tools Framework
- Blackhat Hacker Tools
- Pentest Tools Download
- Hacker Tools List
- What Is Hacking Tools
- Hack Tools 2019
- Hacker Tools 2019
- New Hacker Tools
- Pentest Reporting Tools
- Hacking Tools And Software
- Pentest Automation Tools
- Hacker Tools 2019
- What Is Hacking Tools
- Pentest Tools Nmap
- Black Hat Hacker Tools
- Hacker Tools For Windows
- Install Pentest Tools Ubuntu
- Hack Apps
- Pentest Tools Website Vulnerability
- Hacker Tools For Windows
- Hacking Tools Usb
- Hacking Tools Windows
- Top Pentest Tools
- Hacking Tools 2019
- Hack Tool Apk
- Best Hacking Tools 2019
- Hack Tools For Mac
- Bluetooth Hacking Tools Kali
- Pentest Tools Open Source
- Kik Hack Tools
- Black Hat Hacker Tools
- Beginner Hacker Tools
- Pentest Tools Linux
- What Is Hacking Tools
- Hacking Apps
- Tools For Hacker
- Top Pentest Tools
- Hacker Tools Mac
- Easy Hack Tools
- Pentest Tools Website Vulnerability
- Pentest Tools For Windows
- Pentest Tools Bluekeep
- Hack Tools Download
- Physical Pentest Tools
- Pentest Automation Tools
- New Hack Tools
- Pentest Tools Alternative
- Hack Tools For Windows
- Hacking Tools For Games
- Black Hat Hacker Tools
- Nsa Hack Tools Download
- Hacking Tools Hardware
- Wifi Hacker Tools For Windows
- Hacking Tools Hardware
- Hacking Tools For Beginners
- Pentest Tools Tcp Port Scanner
- Pentest Tools For Android
- Beginner Hacker Tools
- Physical Pentest Tools
- Hacker Tools
- Pentest Tools Windows
- What Is Hacking Tools
- Hacker
- Github Hacking Tools
- Pentest Tools Apk
- Pentest Tools Download
- Hack Tools For Mac
- World No 1 Hacker Software
- Hack Tools Online
- Hacking Tools Windows
- Hacker Search Tools
- Hacker Tool Kit
- Hacking Tools Online
- Nsa Hack Tools Download
- Pentest Box Tools Download
- Hacking Tools Github
- Hacking Tools For Windows Free Download
- Nsa Hack Tools Download
- Hacker Tools Apk Download
- Github Hacking Tools
- Pentest Tools Bluekeep
- Pentest Tools Github
- Best Hacking Tools 2020
- World No 1 Hacker Software
- Hacker Tools Mac
- Hacker Tools For Mac
- Pentest Tools Free
- Hacker Tools 2019
- Pentest Tools
- Hacker Tools 2019
- How To Make Hacking Tools
- Pentest Tools Android
- Hacker Tools Mac
- Hacker Tools For Windows
- Hacking Tools Github
- Hack Tools Online
- Github Hacking Tools
- Nsa Hack Tools Download
- Hack Apps
- Tools 4 Hack
- Hacker Tools For Pc
- Hacker Tools For Mac
- Hacker Tools Windows
- Hack Tools 2019
- New Hack Tools
- Hack Rom Tools
- Hack Tools Github
- Hack Tools For Windows
- Hack Tool Apk
- Hacking Apps
- Hacker Tools 2020
- Hack Apps
- Hacking Tools For Windows Free Download
- Hacking Apps
- Hak5 Tools
- Hacks And Tools
- Hacking Tools For Pc
- Hack Tools Download
- Beginner Hacker Tools
- Hack Tools Github
- Pentest Tools Subdomain
- Underground Hacker Sites
- Hacking Tools Hardware
- Tools For Hacker
- Hacker Tools 2020
- Hacking Tools Usb
No comments:
Post a Comment