CharmPower

CharmPower, also known as POWERSTAR or GhostEcho, is a malicious software developed by the Iranian hacking group known as Charming Kitten. This PowerShell-based modular backdoor malware has recently been updated and distributed through spear-phishing campaigns, as discovered by Volexity. The malware is designed to exploit vulnerabilities in systems, establish persistence, gather information, and execute commands. This new version of CharmPower was found to be more evolved, showing that Charming Kitten has been advancing their malware alongside their spear-phishing techniques. In addition to CharmPower, the group is associated with other malware such as GorjolEcho and GORBLE, identified by Google-Mandiant. The NokNok modules mirror much of the functionality of the modules for CharmPower, with some overlaps in source code with macOS malware previously attributed to the group in 2017. Notably, CharmPower shares similarities with malware like GhostEcho and MacDownloader, leading Proofpoint to attribute the attack to the Iranian group with high confidence. The updated version of CharmPower was delivered via spear-phishing campaigns targeting individuals affiliated with the security community, think tanks, or universities in Israel, North America, and Europe. The malware was sent via an email containing an .LNK file inside a password-protected .RAR file, demonstrating the group's evolving spear-phishing techniques. As a stealthy and bespoke group, Charming Kitten aims to stay under the radar while focusing on improving its social engineering tactics to increase return on investment.