Iranian Hackers Using New PowerShell Backdoor in Cyber Espionage Attacks

An advanced persistent threat group with links to Iran has
updated its malware toolset to include a novel PowerShell-based
implant called PowerLess Backdoor, according to new research
published by Cybereason.

The Boston-headquartered cybersecurity company attributed the
malware to a hacking group known as Charming Kitten (aka
Phosphorous, APT35, or TA453^[1]), while also calling out
the backdoor’s evasive PowerShell execution.

“The PowerShell code runs in the context of a .NET application,
thus not launching ‘powershell.exe’ which enables it to evade
security products,” Daniel Frank, senior malware researcher at
Cybereason, said^[2]. “The toolset analyzed
includes extremely modular, multi-staged malware that decrypts and
deploys additional payloads in several stages for the sake of both
stealth and efficacy.”

The threat actor, which is active since at least 2017, has been
behind a series of campaigns in recent years, including those
wherein the adversary posed as journalists^[3]
and scholars^[4]
to deceive targets into installing malware and stealing classified
information.

Earlier this month, Check Point Research disclosed details of an
espionage operation that involved the hacking group exploiting the
Log4Shell vulnerabilities^[5] to deploy a modular
backdoor dubbed CharmPower for follow-on attacks.

The latest refinements to its arsenal, as spotted by Cybereason,
constitutes an entirely new toolset that encompasses the PowerLess
Backdoor, which is capable of downloading and executing additional
modules such as a browser info-stealer and a keylogger.

Also potentially linked to the same developer of the backdoor
are a number of other malware artifacts, counting an audio
recorder, an earlier variant of the information stealer, and what
the researchers suspect to be an unfinished ransomware variant^[6] coded in .NET.

Furthermore, infrastructure overlaps have been identified
between the Phosphorus group and a new ransomware strain called
Memento^[7], which first emerged in
November 2021 and took the unusual step of locking files within
password-protected archives, followed by encrypting the password
and deleting the original files, after their attempts to encrypt
the files directly were blocked by endpoint protection.

“The activity of Phosphorus^[8]
with regard to ProxyShell took place in about the same time frame
as Memento,” Frank said. “Iranian threat actors were also reported
to be turning to ransomware during that period, which strengthens
the hypothesis that Memento is operated by an Iranian threat
actor.”