Thursday, July 25, 2024
EHA

DeathStalker Hacker Group’s New PowerPepper Malware Evade Antivirus Detection to Bypass Windows

Researchers uncovered a new Malvertising campaign PowerPepper from DeathStalker threat actor group that is active since 2012, and actively attacking various organizations around the world with financial motivation.

DeathStalker group does not fit under the traditional cybercrime group instead, researchers believe that the group is operating as a hack-for-hire service.

Attackers leveraged the anti-detection and antivirus evasion techniques to avoid detection and are used a method called “dead-drop resolvers” (DDRs) that helps attackers to host their obfuscated content hosted on major public web services like YouTube, Twitter, Reddit to target the victims.

PowerPepper considers a previously unknown implant that leveraged DNS over HTTPS as a C2 channel and spotted in wide that attacking various organizations in June 2020.

Attack using a spear phishing campaign to target the victims and using a Word document to drop the payload, and the malware has been continuously operating and developing.

PowerPepper Operation and Infection Process

Attackers cleverly operating the PowerPepper malware, and it is a Windows in-memory PowerShell backdoor that can execute remotely.

Also, it is leveraging various techniques such as detecting mouse movements, filtering the client’s MAC addresses, and adapting its execution flow to evade the AV detection and sandbox execution.

The command and control server using for this campaign based on the communications via DNS over HTTPS (DoH). inorder to establish a DoH request to a C2 server, PowerPepper initially tries to leverage Microsoft’s Excel as a Web client then comes back to PowerShell’s standard web client.

Attackers rely upon AES encryption to ensure the C2 communications content between the implant and servers is encrypted.

PowerPepper Delivery Chains

DeathStalker using two different types of Delivery Chain is Macro-based delivery chain and LNK-based delivery chain.

The macro-based delivery chain being uncovered back in July 2020 via a malicious Word document but the researchers unable to identify that how this malicious document has been distributed and believed that the item is either embedded as a spear-phishing email body or downloaded from a malicious link in a spear-phishing email as previously said.

According to Kaspersky’s report, the LNK-based delivery chain is a Windows shortcut file-based, and it is very much similar to macro-based, but there are two major changes.

  • the malicious macros logic is moved to malicious PowerShell scripts, and the first one is directly embedded in the shortcut file, so there are no more VBA macros;
  • the Word document from this chain is just a decoy and malicious files storage pack, and is downloaded from a remote location (a public file sharing service) instead of directly embedded somewhere.

There are 6 following tricks are used by this PowerPepper to perform the successful attacks which you can read detailed here.

  1. hide things in Word embedded shape properties (and make macro comments fun again)
  2.  use Windows Compiled HTML Help (CHM) files as archives for malicious files
  3. masquerade and obfuscate persistent files
  4. hide your implant between two ferns…
  5. get lost in Windows shell command translation
  6. kick start it all with a signed binary proxy execution

According to the tracking report, attackers are targeting several countries around the world, but the researchers could not precisely identify PowerPepper targets, but law and consultancy firms have been frequent targets of the actor.

Prevention Measures

  • Content hosts can regularly scan hosted files for malicious content, where regulations allow. 
  • Website owners and editors need to frequently and responsively update their CMS backends as well as associated plugins.
  • Ensure the protection on privileged and remote access, with client network address filtering, MFA and access logging on all backend endpoints.
  • Enterprise network users are strongly recommended to restrict script engine link PowerShell and  set up endpoint protection software on end-user computers and content servers.
  • Train employees and ensure them that they neveropen Windows shortcuts that were downloaded from a remote location or attached to an email, open attachments or click links in emails from unknown senders, or enable macros in documents from unverified sources.
Website

Latest articles

ShadowRoot Ransomware Attacking Organizations With Weaponized PDF Documents

A rudimentary ransomware targets Turkish businesses through phishing emails with ".ru" domain sender addresses....

BreachForumsV1 Database Leaked: Private messages, Emails & IP Exposed

BreachForumsV1, a notorious online platform for facilitating illegal activities, has reportedly suffered a massive...

250 Million Hamster Kombat Players Targeted Via Android And Windows Malware

Despite having simple gameplay, the new Telegram clicker game Hamster Kombat has become very...

Beware Of Malicious Python Packages That Steal Users Sensitive Data

Malicious Python packages uploaded by "dsfsdfds" to PyPI infiltrated user systems by exfiltrating sensitive...

Chinese Hackers Using Shared Framework To Create Multi-Platform Malware

Shared frameworks are often prone to hackers' abuses as they have been built into...

BlueStacks Emulator For Windows Flaw Exposes Millions Of Gamers To Attack

A significant vulnerability was discovered in BlueStacks, the world's fastest Android emulator and cloud...

Google Chrome 127 Released with a fix for 24 Security Vulnerabilities

Google has unveiled the latest version of its Chrome browser, Chrome 127, which is...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles