An advanced persistent threat group with links to Iran has updated its malware toolset to include a novel PowerShell-based implant called PowerLess Backdoor, according to new research published by Cybereason.
The Boston-headquartered cybersecurity company attributed the malware to a hacking group known as Charming Kitten (aka Phosphorous, APT35, or TA453), while also calling out the backdoor's evasive PowerShell execution.
"The PowerShell code runs in the context of a .NET application, thus not launching 'powershell.exe' which enables it to evade security products," Daniel Frank, senior malware researcher at Cybereason, said. "The toolset analyzed includes extremely modular, multi-staged malware that decrypts and deploys additional payloads in several stages for the sake of both stealth and efficacy."
The threat actor, which is active since at least 2017, has been behind a series of campaigns in recent years, including those wherein the adversary posed as journalists and scholars to deceive targets into installing malware and stealing classified information.
Earlier this month, Check Point Research disclosed details of an espionage operation that involved the hacking group exploiting the Log4Shell vulnerabilities to deploy a modular backdoor dubbed CharmPower for follow-on attacks.
The latest refinements to its arsenal, as spotted by Cybereason, constitutes an entirely new toolset that encompasses the PowerLess Backdoor, which is capable of downloading and executing additional modules such as a browser info-stealer and a keylogger.
Also potentially linked to the same developer of the backdoor are a number of other malware artifacts, counting an audio recorder, an earlier variant of the information stealer, and what the researchers suspect to be an unfinished ransomware variant coded in .NET.
Furthermore, infrastructure overlaps have been identified between the Phosphorus group and a new ransomware strain called Memento, which first emerged in November 2021 and took the unusual step of locking files within password-protected archives, followed by encrypting the password and deleting the original files, after their attempts to encrypt the files directly were blocked by endpoint protection.
"The activity of Phosphorus with regard to ProxyShell took place in about the same time frame as Memento," Frank said. "Iranian threat actors were also reported to be turning to ransomware during that period, which strengthens the hypothesis that Memento is operated by an Iranian threat actor."
Continue reading- Black Hat Hacker Tools
- Hack Tools Pc
- Hack Tool Apk
- Pentest Tools Apk
- Hacker Tools
- Tools For Hacker
- Hack Tool Apk No Root
- Pentest Tools Website
- Pentest Tools Kali Linux
- Hacker Search Tools
- Pentest Tools Find Subdomains
- Usb Pentest Tools
- Hacking App
- Best Hacking Tools 2019
- Hacker
- Hack Tool Apk
- Hacker Tools For Windows
- Hacking Tools For Beginners
- Underground Hacker Sites
- Hacking Tools For Mac
- Pentest Tools
- Hacking Tools
- Hacker Tools For Pc
- Pentest Tools Bluekeep
- Pentest Tools Android
- Hack Tools Download
- Pentest Box Tools Download
- Hack Tools For Games
- Hacking Tools Download
- Pentest Tools Online
- Best Hacking Tools 2020
- Hacker Tools
- Pentest Recon Tools
- Pentest Tools Find Subdomains
- Hacker Hardware Tools
- Black Hat Hacker Tools
- Pentest Tools For Android
- Hack Tools Pc
- Pentest Tools For Ubuntu
- Tools For Hacker
- Pentest Tools For Mac
- Pentest Tools Website
- Nsa Hacker Tools
- Hacking Tools Software
- Tools For Hacker
- Pentest Recon Tools
- Hack Tools For Windows
- Hacking App
- Hacker Tools Free Download
- Hack Tools For Windows
- Hacker Tools For Windows
- Hacking Tools For Windows Free Download
- Hackers Toolbox
- Hacker Tools Windows
- Hacking Tools For Mac
- Hacking Apps
- Hacking Tools For Pc
- Hack Tools Online
- Tools 4 Hack
- Physical Pentest Tools
- Pentest Tools Review
- Computer Hacker
- What Are Hacking Tools
- Pentest Recon Tools
- Hacker Tools For Windows
- Hack Tool Apk No Root
- Install Pentest Tools Ubuntu
- Hacker Tools Apk Download
- Hacker Tools Software
- Hack And Tools
- Hacking Tools 2019
- Pentest Tools For Ubuntu
- Hak5 Tools
- Pentest Tools Windows
- Hackrf Tools
- Hackrf Tools
- Hacker Hardware Tools
- Install Pentest Tools Ubuntu
- Hacker Techniques Tools And Incident Handling
- Hack App
- Pentest Tools Free
- Pentest Tools For Ubuntu
- Hack Website Online Tool
- Pentest Tools Website Vulnerability
- Pentest Tools Free
- Hack Tool Apk No Root
- How To Make Hacking Tools
- Hacker Security Tools
- Pentest Tools Android
- Pentest Tools For Ubuntu
- Top Pentest Tools
- Hacker
- Hacking Tools For Mac
- Hack Tools Github
- Pentest Tools
- Pentest Tools Linux
- Hacker
- Hacking Tools Github
- Game Hacking
- Hackrf Tools
- Hack Tools
- Nsa Hacker Tools
- Pentest Tools Open Source
- Pentest Tools Framework
- Hack Tool Apk No Root
- Hack Tool Apk
- Wifi Hacker Tools For Windows
- Hack Tools
- Hack Tools For Games
- Pentest Tools Tcp Port Scanner
- Pentest Tools For Ubuntu
- Hacks And Tools
- Top Pentest Tools
- Hacking Tools Github
- Ethical Hacker Tools
- Hacker Search Tools
- Hack Tools Github
- Pentest Tools
- Game Hacking
- What Are Hacking Tools
- Free Pentest Tools For Windows
- Termux Hacking Tools 2019
- Hacking Tools Kit
- Underground Hacker Sites
- Free Pentest Tools For Windows
- Pentest Tools Github
- Hacking Tools Name
- Pentest Tools Nmap
- Hack App
- Pentest Tools Open Source
- Hacker Tools For Windows
- Hack Tools
- Pentest Tools For Windows
- Pentest Tools Online
- Pentest Tools Apk
- Computer Hacker
- Bluetooth Hacking Tools Kali
- Growth Hacker Tools
- Hacking Tools For Kali Linux
- Ethical Hacker Tools
- Pentest Tools Open Source
- Hack App
- Hacker Tools Free Download
- Hackrf Tools
- Pentest Tools Free
- Hacks And Tools
- Hacking Tools For Beginners
- Hack Tools
- Hacking Tools Kit
- Hacker Tool Kit
- Top Pentest Tools
- Hack Tools For Windows
- What Are Hacking Tools
- Pentest Box Tools Download
- Hak5 Tools
- Android Hack Tools Github
- Pentest Tools Subdomain
- Pentest Tools Windows
- Pentest Tools Apk
- Hacker Tools For Pc
- Hackers Toolbox
- Pentest Tools Website
- Hack Tools For Games
- Hacker Tools Windows
- Hack Tools
- Hacking Tools
- Hacker Tools For Windows
- Hak5 Tools
- Hack Tools For Mac
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.