Wednesday, April 17, 2024

DeathStalker Hacker Group’s New PowerPepper Malware Evade Antivirus Detection to Bypass Windows

Researchers uncovered a new Malvertising campaign PowerPepper from DeathStalker threat actor group that is active since 2012, and actively attacking various organizations around the world with financial motivation.

DeathStalker group does not fit under the traditional cybercrime group instead, researchers believe that the group is operating as a hack-for-hire service.

Attackers leveraged the anti-detection and antivirus evasion techniques to avoid detection and are used a method called “dead-drop resolvers” (DDRs) that helps attackers to host their obfuscated content hosted on major public web services like YouTube, Twitter, Reddit to target the victims.

PowerPepper considers a previously unknown implant that leveraged DNS over HTTPS as a C2 channel and spotted in wide that attacking various organizations in June 2020.

Attack using a spear phishing campaign to target the victims and using a Word document to drop the payload, and the malware has been continuously operating and developing.

PowerPepper Operation and Infection Process

Attackers cleverly operating the PowerPepper malware, and it is a Windows in-memory PowerShell backdoor that can execute remotely.

Also, it is leveraging various techniques such as detecting mouse movements, filtering the client’s MAC addresses, and adapting its execution flow to evade the AV detection and sandbox execution.

The command and control server using for this campaign based on the communications via DNS over HTTPS (DoH). inorder to establish a DoH request to a C2 server, PowerPepper initially tries to leverage Microsoft’s Excel as a Web client then comes back to PowerShell’s standard web client.

Attackers rely upon AES encryption to ensure the C2 communications content between the implant and servers is encrypted.

PowerPepper Delivery Chains

DeathStalker using two different types of Delivery Chain is Macro-based delivery chain and LNK-based delivery chain.

The macro-based delivery chain being uncovered back in July 2020 via a malicious Word document but the researchers unable to identify that how this malicious document has been distributed and believed that the item is either embedded as a spear-phishing email body or downloaded from a malicious link in a spear-phishing email as previously said.

According to Kaspersky’s report, the LNK-based delivery chain is a Windows shortcut file-based, and it is very much similar to macro-based, but there are two major changes.

  • the malicious macros logic is moved to malicious PowerShell scripts, and the first one is directly embedded in the shortcut file, so there are no more VBA macros;
  • the Word document from this chain is just a decoy and malicious files storage pack, and is downloaded from a remote location (a public file sharing service) instead of directly embedded somewhere.

There are 6 following tricks are used by this PowerPepper to perform the successful attacks which you can read detailed here.

  1. hide things in Word embedded shape properties (and make macro comments fun again)
  2.  use Windows Compiled HTML Help (CHM) files as archives for malicious files
  3. masquerade and obfuscate persistent files
  4. hide your implant between two ferns…
  5. get lost in Windows shell command translation
  6. kick start it all with a signed binary proxy execution

According to the tracking report, attackers are targeting several countries around the world, but the researchers could not precisely identify PowerPepper targets, but law and consultancy firms have been frequent targets of the actor.

Prevention Measures

  • Content hosts can regularly scan hosted files for malicious content, where regulations allow. 
  • Website owners and editors need to frequently and responsively update their CMS backends as well as associated plugins.
  • Ensure the protection on privileged and remote access, with client network address filtering, MFA and access logging on all backend endpoints.
  • Enterprise network users are strongly recommended to restrict script engine link PowerShell and  set up endpoint protection software on end-user computers and content servers.
  • Train employees and ensure them that they neveropen Windows shortcuts that were downloaded from a remote location or attached to an email, open attachments or click links in emails from unknown senders, or enable macros in documents from unverified sources.

Latest articles

Xiid SealedTunnel: Unfazed by Yet Another Critical Firewall Vulnerability (CVE-2024-3400)

In the wake of the recent disclosure of a critical vulnerability (CVE-2024-3400) affecting a...

Cerber Linux Ransomware Exploits Atlassian Servers to Take Full Control

Security researchers at Cado Security Labs have uncovered a new variant of the Cerber...

FGVulDet – New Vulnerability Detector to Analyze Source Code

Detecting source code vulnerabilities aims to protect software systems from attacks by identifying inherent...

North Korean Hackers Abuse DMARC To Legitimize Their Emails

DMARC is targeted by hackers as this serves to act as a preventative measure...

L00KUPRU Ransomware Attackers discovered in the wild

A new variant of the Xorist ransomware, dubbed L00KUPRU, has been discovered in the...

Oracle Releases Biggest Security Update in 2024 – 372 Vulnerabilities Are Fixed – Update Now!

Oracle has released its April 2024 Critical Patch Update (CPU), addressing 372 security vulnerabilities...

Outlook Login Panel Themed Phishing Attack Evaded All Antivirus Detections

Cybersecurity researchers have uncovered a new phishing attack that has bypassed all antivirus detections.The...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles