Iranian state-sponsored threat operation Charming Kitten, also known as APT35, Mint Sandstorm, Cobalt Illusion, and Yellow Garuda, has launched a new wave of spear-phishing attacks deploying the POWERSTAR backdoor since May, according to The Hacker News.
Additional measures to prevent detection have been employed by Charming Kitten in the latest POWERSTAR attacks, which involved the use of an LNK file within a password-protected RAR file to facilitate backdoor download from Backblaze, a report from Volexity revealed.
Researchers also discovered that the backdoor does not only allow remote PowerShell and C# command execution but also the collection of system data and screenshots, as well as further module downloads and execution, while removing persistence-related registry keys and other indicators of malicious activity. Another POWERSTAR variant that allows hard-coded C2 server retrieval through decentralized InterPlanetary Filesystem-stored file decoding.
"The references to persistence mechanisms and executable payloads within the POWERSTAR Cleanup module strongly suggests a broader set of tools used by Charming Kitten to conduct malware-enabled espionage," said researchers.
As part of its latest attacks discovered in June, Tropic Tropper exploited several known Microsoft Exchange Server and Adobe ColdFusion vulnerabilities to distribute an updated China Chopper web shell on a server hosting the Umbraco open-source content management system.
More than 50 Alibaba-hosted command-and-control servers have been leveraged to facilitate the distribution of the backdoor, which impersonates the Java, bash, sshd, SQLite, and edr-agent utilities.
Angola and the Democratic Republic of Congo, which is a new Intellexa client, may have leveraged new Predator infrastructure to enable spyware staging and exploitation, according to an analysis from Recorded Future's Insikt Group.