Summary: [/subscribe_to_unlock_form]
Summary: [emaillocker id="1283"]
Charming Kitten, an Iran-affiliated nation-state actor known for its adept use of social engineering, has been linked to a spear-phishing campaign involving a sophisticated PowerShell backdoor named POWERSTAR. Security researchers from Volexity have reported an updated version of the malware that boasts improved operational security measures, making it harder to analyze and gather intelligence. Charming Kitten's modus operandi revolves around creating tailored personas on social media platforms to build trust with targets before delivering malicious links. The group has previously been associated with various names, including APT35, Cobalt Illusion, Mint Sandstorm, and Yellow Garuda, and is now seen incorporating multiple espionage tools like PowerLess and BellaCiao in its recent intrusions.
POWERSTAR, it’s use in attacks exploiting Log4Shell vulnerabilities in publicly-exposed Java applications. Since then, it has been utilized in at least two other campaigns, showcasing the continued evolution of Charming Kitten's techniques. The recent May 2023 attack wave involving POWERSTAR deploys an LNK file within a password-protected RAR file to download the backdoor from Backblaze, employing methods to hinder analysis and reduce the risk of detection. The malware exhibits an extensive array of features, enabling it to execute PowerShell and C# commands remotely, set up persistence, collect system information, download and execute modules, and carry out various monitoring tasks.
Multiple variants of POWERSTAR, one of which attempts to retrieve a hard-coded command-and-control (C2) server by decoding a file stored on the decentralized InterPlanetary Filesystem (IPFS), indicating an effort to enhance the attack infrastructure's resilience. Concurrently, the cybersecurity community has also noticed MuddyWater using a previously undocumented C2 framework named PhonyC2 to distribute malicious payloads to compromised hosts. Despite these developments, Charming Kitten's overall strategy and use of POWERSTAR remain consistent, with the malware showing a refined cleanup module and broader persistence mechanisms, reflecting the group's ongoing commitment to espionage activities and avoiding detection.
Charming Kitten's use of sophisticated social engineering, coupled with a constantly evolving arsenal of espionage tools like POWERSTAR, poses significant challenges for cybersecurity professionals in detecting and mitigating the threats posed by nation-state actors. Organizations must remain vigilant and implement robust security measures to protect against such sophisticated attacks.
Threat Profile:
| Tactic | Technique Id | Technique |
| Initial Access | T1566 | Phishing |
| Execution | T1204 | User Execution |
| T1059 | Command and Scripting Interpreter | |
| Persistence | T1547 | Boot or Logon AutoStart Execution |
| Defense Evasion | T1027 | Obfuscated Files or Information |
| T1070 | Indicator Removal | |
| Credential Access | T1056 | Input Capture |
| Collection | T1119 | Automated Collection |
| Exfiltration | T1041 | Exfiltration Over C2 Channel |
| Impact | T1485 | Data Destruction |
References:
The following reports contain further technical details:
https://thehackernews.com/2023/06/iranian-hackers-charming-kitten-utilize.html
[/emaillocker]