[ad_1]
A complicated persistent risk group with hyperlinks to Iran has up to date its malware toolset to incorporate a novel PowerShell-based implant known as PowerLess Backdoor, based on new analysis printed by Cybereason.
The Boston-headquartered cybersecurity firm attributed the malware to a hacking group often called Charming Kitten (aka Phosphorous, APT35, or TA453), whereas additionally calling out the backdoor’s evasive PowerShell execution.
“The PowerShell code runs within the context of a .NET software, thus not launching ‘powershell.exe’ which allows it to evade safety merchandise,” Daniel Frank, senior malware researcher at Cybereason, mentioned. “The toolset analyzed contains extraordinarily modular, multi-staged malware that decrypts and deploys further payloads in a number of levels for the sake of each stealth and efficacy.”
The risk actor, which is energetic since at the least 2017, has been behind a collection of campaigns in recent times, together with these whereby the adversary posed as journalists and students to deceive targets into putting in malware and stealing labeled info.
Earlier this month, Test Level Analysis disclosed particulars of an espionage operation that concerned the hacking group exploiting the Log4Shell vulnerabilities to deploy a modular backdoor dubbed CharmPower for follow-on assaults.
The most recent refinements to its arsenal, as noticed by Cybereason, constitutes a completely new toolset that encompasses the PowerLess Backdoor, which is able to downloading and executing further modules reminiscent of a browser info-stealer and a keylogger.
Additionally probably linked to the identical developer of the backdoor are quite a lot of different malware artifacts, counting an audio recorder, an earlier variant of the data stealer, and what the researchers suspect to be an unfinished ransomware variant coded in .NET.
Moreover, infrastructure overlaps have been recognized between the Phosphorus group and a brand new ransomware pressure known as Memento, which first emerged in November 2021 and took the bizarre step of locking recordsdata inside password-protected archives, adopted by encrypting the password and deleting the unique recordsdata, after their makes an attempt to encrypt the recordsdata straight have been blocked by endpoint safety.
“The exercise of Phosphorus with regard to ProxyShell befell in about the identical time-frame as Memento,” Frank mentioned. “Iranian risk actors have been additionally reported to be turning to ransomware throughout that interval, which strengthens the speculation that Memento is operated by an Iranian risk actor.”
[ad_2]
