APT

Iran-linked Charming Kitten APT enhanced its POWERSTAR Backdoor

Iran-linked Charming Kitten group used an updated version of the PowerShell backdoor called POWERSTAR in a spear-phishing campaign.

Security firm Volexity observed the Iran-linked Charming Kitten (aka APT35PhosphorusNewscaster, and Ajax Security Team) group using an updated version of the PowerShell backdoor POWERSTAR in a spear-phishing campaign.

Iran-linked Charming Kitten group, (aka APT35PhosphorusNewscaster, and Ajax Security Team) made the headlines in 2014 when experts at iSight issued a report describing the most elaborate net-based spying campaign organized by Iranian hackers using social media.

Microsoft has been tracking the threat actors at least since 2013, but experts believe that the cyberespionage group has been active since at least 2011 targeting journalists and activists in the Middle East, as well as organizations in the United States, and entities in the U.K., Israel, Iraq, and Saudi Arabia

“However, in a recently detected spear-phishing campaign, Volexity discovered that Charming Kitten was attempting to distribute an updated version of one of their backdoors, which Volexity calls POWERSTAR (also known as CharmPower).” reads the report published by Volexity.

“This new version of POWERSTAR was analyzed by the Volexity team and led the to the discovery that Charming Kitten has been evolving their malware alongside their spear-phishing techniques”

The threat actors enhanced anti-analysis measures of their POWERSTAR malware.

The POWERSTAR implant was first analyzed by Check Point researchers in early January 2022 while investigating attacks exploiting the Log4Shell vulnerabilities.

Volexity first spotted the POWERSTAR backdoor in 2021, the experts observed the Iranian APT distributing the malicious code in a surprising number of different ways.

The version observed in 2021 was rudimentary, the threat actors distributed it using a malicious macro embedded in DOCM file.

In Many, Volexity observed Charming Kitten attempting to distribute POWERSTAR via spear-phishing messages with an LNK file inside a password-protected RAR file. Upon executing the LNK files, the POWERSTAR backdoor is downloaded from Backblaze and attacker-controlled infrastructure.

The researchers pointed out that in recent months, Charming Kitten replaced their previously preferred cloud-hosting providers (OneDrive, AWS S3, Dropbox) with privately hosted infrastructure, Backblaze and IPFS.

The target of the attack was an organization that had published an article related to Iran.

The threat actors initially contacted the victims, asking them if they would be open to reviewing a document they had written related to US foreign policy.

Once the victim accepted to review the document, Charming Kitten continued the interaction with another benign email containing a list of questions, to which the target then responded with answers. After multiple legitimate interactions, Charming Kitten finally sent a “draft report” to the victims. The “draft report” a password-protected RAR file containing a malicious LNK file. The attackers sent the password for the RAR archive in a separate email.

In order to make the backdoor hard to analyze, the decryption method is delivered separately from the initial code and avoids writing it on the disk.

“This has the added bonus of acting as an operational guardrail, as decoupling the decryption method from its command-and-control (C2) server prevents future successful decryption of the corresponding POWERSTAR payload.” continues the report.

The backdoor can remotely execute PowerShell and CSharp commands and code blocks. The malware achieves persistence via Startup tasks, Registry Run keys, and Batch/PowerShell scripts.

The malware used multiple C2 channels, including cloud file hosts, attacker-controlled servers, and IPFS-hosted files. The backdoor gathers system information, can take screenshots and enumerates running processes.

The Charming Kitten APT group expanded the cleanup module, which is used to erase all traces of the infection.

“Since Volexity first observed POWERSTAR in 2021, Charming Kitten has reworked the malware to make detection more difficult. The most significant change is the downloading of the decryption function from remotely hosted files. As previously discussed, this technique hinders detection of the malware outside of memory, and it gives the attacker an effective kill switch to prevent future analysis of the malware’s key functionality.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, IRAN)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

U.S. Court rules against NSO Group in WhatsApp spyware Lawsuit

A U.S. court ruled in favor of WhatsApp against NSO Group, holding the spyware vendor…

58 minutes ago

Lazarus APT targeted employees at an unnamed nuclear-related organization

North Korea-linked Lazarus Group targeted employees of an unnamed nuclear-related organization in January 2024. Kaspersky…

7 hours ago

SECURITY AFFAIRS MALWARE NEWSLETTER – ROUND 25

Security Affairs Malware newsletter includes a collection of the best articles and research on malware…

1 day ago

Security Affairs newsletter Round 503 by Pierluigi Paganini – INTERNATIONAL EDITION

A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles…

1 day ago

US charged Dual Russian and Israeli National as LockBit Ransomware developer

US authorities charged a dual Russian and Israeli national for being a developer of the…

1 day ago

BadBox rapidly grows, 190,000 Android devices infected

Experts uncovered a botnet of 190,000 Android devices infected by BadBox bot, primarily Yandex smart…

2 days ago

This website uses cookies.