Researchers uncovered a new Malvertising campaign PowerPepper from DeathStalker threat actor group that is active since 2012, and actively attacking various organizations around the world with financial motivation.

DeathStalker group does not fit under the traditional cybercrime group instead, researchers believe that the group is operating as a hack-for-hire service.

Attackers leveraged the anti-detection and antivirus evasion techniques to avoid detection and are used a method called “dead-drop resolvers” (DDRs) that helps attackers to host their obfuscated content hosted on major public web services like YouTube, Twitter, Reddit to target the victims.

PowerPepper considers a previously unknown implant that leveraged DNS over HTTPS as a C2 channel and spotted in wide that attacking various organizations in June 2020.

Attack using a spear phishing campaign to target the victims and using a Word document to drop the payload, and the malware has been continuously operating and developing.

PowerPepper Operation and Infection Process

Attackers cleverly operating the PowerPepper malware, and it is a Windows in-memory PowerShell backdoor that can execute remotely.

Also, it is leveraging various techniques such as detecting mouse movements, filtering the client’s MAC addresses, and adapting its execution flow to evade the AV detection and sandbox execution.

The command and control server using for this campaign based on the communications via DNS over HTTPS (DoH). inorder to establish a DoH request to a C2 server, PowerPepper initially tries to leverage Microsoft’s Excel as a Web client then comes back to PowerShell’s standard web client.

Attackers rely upon AES encryption to ensure the C2 communications content between the implant and servers is encrypted.

PowerPepper Delivery Chains

DeathStalker using two different types of Delivery Chain is Macro-based delivery chain and LNK-based delivery chain.

The macro-based delivery chain being uncovered back in July 2020 via a malicious Word document but the researchers unable to identify that how this malicious document has been distributed and believed that the item is either embedded as a spear-phishing email body or downloaded from a malicious link in a spear-phishing email as previously said.

According to Kaspersky’s report, the LNK-based delivery chain is a Windows shortcut file-based, and it is very much similar to macro-based, but there are two major changes.

• the malicious macros logic is moved to malicious PowerShell scripts, and the first one is directly embedded in the shortcut file, so there are no more VBA macros;
• the Word document from this chain is just a decoy and malicious files storage pack, and is downloaded from a remote location (a public file sharing service) instead of directly embedded somewhere.

There are 6 following tricks are used by this PowerPepper to perform the successful attacks which you can read detailed here.

1. hide things in Word embedded shape properties (and make macro comments fun again)
2.  use Windows Compiled HTML Help (CHM) files as archives for malicious files
3. masquerade and obfuscate persistent files
4. hide your implant between two ferns…
5. get lost in Windows shell command translation
6. kick start it all with a signed binary proxy execution

According to the tracking report, attackers are targeting several countries around the world, but the researchers could not precisely identify PowerPepper targets, but law and consultancy firms have been frequent targets of the actor.

Prevention Measures

• Content hosts can regularly scan hosted files for malicious content, where regulations allow. 
• Website owners and editors need to frequently and responsively update their CMS backends as well as associated plugins.
• Ensure the protection on privileged and remote access, with client network address filtering, MFA and access logging on all backend endpoints.
• Enterprise network users are strongly recommended to restrict script engine link PowerShell and  set up endpoint protection software on end-user computers and content servers.
• Train employees and ensure them that they neveropen Windows shortcuts that were downloaded from a remote location or attached to an email, open attachments or click links in emails from unknown senders, or enable macros in documents from unverified sources.