Loading malware…
PowerLess is a modular PowerShell-based backdoor associated with the Iranian threat actor APT35, also tracked as Phosphorus and Charming Kitten. It is designed for stealthy post-compromise access on Windows systems and is notable for executing PowerShell functionality without launching powershell.exe, instead running within the context of a .NET application to reduce detection opportunities. Reported variants have also incorporated AMSI and ETW bypass techniques and encrypted payload handling to further evade defensive controls.
PowerLess supports encrypted command-and-control communications and enables remote command execution and process termination on compromised hosts. The malware has been used as a multi-stage framework that decrypts and deploys additional modules, including browser data theft and keylogging components. Its browser collection capability can read Chrome and Microsoft Edge browser database files, and reported workflows include local staging of collected browser and keystroke data prior to exfiltration. PowerLess has also been observed encrypting browser database material before exfiltration.
Operational reporting links PowerLess to espionage activity by APT35 against organizations and individuals of intelligence interest. Delivery has been associated with malicious shortcut files carrying encrypted payloads, while broader APT35 operations commonly combine social engineering with exploitation of internet-facing enterprise software. PowerLess forms part of a wider Charming Kitten malware ecosystem that includes other PowerShell backdoors and tailored droppers used in credential theft, surveillance, and follow-on intrusion activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The threat actor is known to exploit Fortinet CVE-2018-13379, Exchange ProxyShell, and the log4j vulnerabilities. Thanks to Deep Instinct’s prevention capabilities the threat actor was unsuccessful in executing the payloads in a customer environment despite successful exploitation of the Exchange server.
In this post, we highlight some of the activities we recently observed from TunnelVision operators, focusing around exploitation of VMware Horizon Log4j vulnerabilities. TunnelVision attackers have been actively exploiting the vulnerability to run malicious PowerShell commands, deploy backdoors, create backdoor users, harvest credentials and perform lateral movement.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This file is another version of PowerLess which was also linked to PHOSPHORUS.
Although it is not encrypted, it is deobfuscated and executed in a somewhat similar manner to how PowerLess, another backdoor used by the group, executes its PowerShell payload.
Their tools include custom backdoors like FalseFont or Powerless for espionage...
26 distinct techniques documented for this family, organized by ATT&CK tactic.
TunnelVision attackers have been actively exploiting the vulnerability to run malicious PowerShell commands... Typically, the threat actor initially exploits the Log4j vulnerability to run PowerShell commands directly, and then runs further commands by means of PS reverse shells.
An Iranian state-backed hacking group tracked as APT35 (aka Phosphorus or Charming Kitten) is now deploying a new backdoor called PowerLess and developed using PowerShell.
“PowerShell and Cmd serve as the universal backbone for execution across nearly all groups”
TunnelVision attackers have been actively exploiting the vulnerability to run malicious PowerShell commands, deploy backdoors, create backdoor users, harvest credentials and perform lateral movement.
"ADVSTORESHELL encrypts with the 3DES algorithm and a hardcoded key prior to exfiltration."; "Agent Tesla can encrypt data with 3DES..."; "APT32's backdoor has used...RC4 encryption before exfiltration."; "Epic encrypts collected data using a public key framework..."; "Some variants encrypt...with AES and encode it with base64..."; "Prikormka...encrypts it with Blowfish."; "VERMIN encrypts the collected files using 3-DES."; "Zebrocy...RC4...as well as AES...and hexadecimal for encoding"
The content references collection of credential material from local systems, including "Bumblebee can capture and compress stolen credentials from the Registry and volume shadow copies," "GALLIUM collected ... password hashes from the SAM hive in the Registry," and "Windigo has used a script to gather credentials in files left on disk by OpenSSH backdoors."
Eventually, the infection chain reaches PowerLess, a script-based component used to perform subsequent malicious activities, including data theft from the compromised system.
The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.
"AppleSeed has compressed collected data before exfiltration."; "APT28 used a publicly available tool to gather and compress multiple documents..."; "Aria-body has used ZIP to compress data..."; "Cadelspy...compress stolen data into a .cab file."; "Daserf hides collected data in password-protected .rar archives."; "FIN6 has compressed log files into a ZIP archive prior to staging and exfiltration."; "Lazarus Group has compressed exfiltrated data with RAR...archive specified directories in .zip format"; "XCSSET will compress entire ~/Desktop folders..."
The PowerLess backdoor features encrypted command-and-control communication channels, and it allows executing commands and killing running processes on compromised systems.
Reverse Shell #1 uses WebClient UploadFile/DownloadString to "www.microsoft-updateserver[.]cf"; also notes webhook.site for output exfil.
The toolset analyzed includes extremely modular, multi-staged malware that decrypts and deploys additional payloads in several stages for the sake of both stealth and efficacy. | The threat group also used the previously unknown malware to deploy additional modules, including info stealers and keyloggers, according to a report published today by the Cybereason Nocturnus Team.
This domain was also used to host a zip file ... containing a custom backdoor ... The dropped executable contains an obfuscated version of the reverse shell as described above, beaconing to the same C2 server.
“APT29 has used multiple layers of encryption within malware to protect C2 communication… BITTER has encrypted their C2 communications… MacMa has used TLS encryption… Magic Hound has used an encrypted http proxy in C2 communications… gh0st RAT has encrypted TCP communications…”
“APT29 has used multiple layers of encryption within malware to protect C2 communication… BITTER has encrypted their C2 communications… Emotet has encrypted data before sending to the C2 server… gh0st RAT has encrypted TCP communications to evade detection… Gomir uses a custom encryption algorithm…”
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Custom backdoor referenced as used for espionage operations; sometimes paired with destructive tooling in campaigns described.
APT35 backdoor enhanced with AMSI/ETW bypasses, AES-encrypted payload delivery via LNK files, and Telegram-based C2.
A PowerShell backdoor used by the group for persistent remote access.
A PowerShell-based backdoor attributed to APT35 that executes without launching powershell.exe, aiding stealthy execution and persistence on Windows environments.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.