An advanced persistent threat group with links to Iran has updated its malware toolset to include a novel PowerShell-based implant called PowerLess Backdoor, according to new research published by Cybereason.
The Boston-headquartered cybersecurity company attributed the malware to a hacking group known as Charming Kitten (aka Phosphorous, APT35, or TA453), while also calling out the backdoor's evasive PowerShell execution.
"The PowerShell code runs in the context of a .NET application, thus not launching 'powershell.exe' which enables it to evade security products," Daniel Frank, senior malware researcher at Cybereason, said. "The toolset analyzed includes extremely modular, multi-staged malware that decrypts and deploys additional payloads in several stages for the sake of both stealth and efficacy."
The threat actor, which is active since at least 2017, has been behind a series of campaigns in recent years, including those wherein the adversary posed as journalists and scholars to deceive targets into installing malware and stealing classified information.
Earlier this month, Check Point Research disclosed details of an espionage operation that involved the hacking group exploiting the Log4Shell vulnerabilities to deploy a modular backdoor dubbed CharmPower for follow-on attacks.
The latest refinements to its arsenal, as spotted by Cybereason, constitutes an entirely new toolset that encompasses the PowerLess Backdoor, which is capable of downloading and executing additional modules such as a browser info-stealer and a keylogger.
Also potentially linked to the same developer of the backdoor are a number of other malware artifacts, counting an audio recorder, an earlier variant of the information stealer, and what the researchers suspect to be an unfinished ransomware variant coded in .NET.
Furthermore, infrastructure overlaps have been identified between the Phosphorus group and a new ransomware strain called Memento, which first emerged in November 2021 and took the unusual step of locking files within password-protected archives, followed by encrypting the password and deleting the original files, after their attempts to encrypt the files directly were blocked by endpoint protection.
"The activity of Phosphorus with regard to ProxyShell took place in about the same time frame as Memento," Frank said. "Iranian threat actors were also reported to be turning to ransomware during that period, which strengthens the hypothesis that Memento is operated by an Iranian threat actor."
More articles- Github Hacking Tools
- Hacking Tools Usb
- Pentest Tools Url Fuzzer
- Best Hacking Tools 2019
- Hack Website Online Tool
- Top Pentest Tools
- Pentest Tools For Mac
- Ethical Hacker Tools
- Hacker Tools Free Download
- Hacking Tools Pc
- Hack Tools For Ubuntu
- Hacker Tools For Mac
- Hacker Search Tools
- Easy Hack Tools
- Pentest Tools Kali Linux
- Hacking Tools Usb
- Pentest Tools Port Scanner
- Hacker Tools
- Hack Tools For Windows
- Pentest Tools For Android
- Hacking Tools Pc
- Hacker Tools
- Hacker Tools For Mac
- Hack Website Online Tool
- Tools Used For Hacking
- Pentest Tools Windows
- Blackhat Hacker Tools
- Beginner Hacker Tools
- Pentest Tools Port Scanner
- Hack Apps
- Hack Tool Apk No Root
- Hacker Tools 2020
- Hacking Tools For Kali Linux
- Computer Hacker
- Tools 4 Hack
- Hack Apps
- Hack And Tools
- Hack Tools
- Wifi Hacker Tools For Windows
- Pentest Tools For Windows
- Computer Hacker
- World No 1 Hacker Software
- Pentest Tools Url Fuzzer
- Hacking Tools Software
- Hacking Tools For Windows
- Pentest Tools For Android
- Hack Tools
- Hacking Tools Online
- Hack Tools
- How To Hack
- Black Hat Hacker Tools
- Pentest Tools Windows
- Pentest Tools Windows
- Underground Hacker Sites
- Hacker Hardware Tools
- Hacker Tools 2019
- Pentest Tools Website
- Pentest Tools Free
- Hacker Search Tools
- Hacker Tools Software
- Hak5 Tools
- Hackers Toolbox
- Hackers Toolbox
- Hacker Search Tools
- Nsa Hack Tools
- New Hacker Tools
- Pentest Tools Kali Linux
- Pentest Automation Tools
- Hacking Tools
- Hack Tools Pc
- Hacking Tools
- Hacker Tools For Windows
- Hack Tools
- Hacking Tools 2019
- Hacker Tools
- Pentest Tools List
- Hacking App
- Hackers Toolbox
- Hack Tools Github
- Hack Tools Download
- Hacker Tools For Pc
- Hacks And Tools
- Hacker Tools
- Hacks And Tools
- Growth Hacker Tools
- Underground Hacker Sites
- Pentest Tools Apk
- How To Make Hacking Tools
- Hacking Tools Name
- Hack Tools For Mac
- Hack Tools Github
- Hacker Tools Hardware
- Wifi Hacker Tools For Windows
- Hacking Tools Kit
- Hack Tools
- Pentest Tools Apk
- Game Hacking
- Pentest Tools Find Subdomains
- Pentest Reporting Tools
No hay comentarios:
Publicar un comentario