CharmPower

CharmPower is a sophisticated malware, identified as an updated version of the Powerstar backdoor, that has been deployed by the Iranian hacking group known as Charming Kitten. The group used this malware in spear-phishing campaigns to target individuals affiliated with think tanks, universities, and the security community across North America, Europe, and Israel. Volexity, a cybersecurity firm, discovered that Charming Kitten was distributing this updated PowerShell-based modular backdoor, which it dubbed POWERSTAR (also known as CharmPower), exploiting the Log4j vulnerability to establish persistence, gather information, and execute commands. The advanced persistent threat (APT) group has continuously evolved its malware arsenal alongside their spear-phishing techniques. In addition to CharmPower, other tools previously utilized by the group include GorjolEcho/PowerStar, TAMECURL, MischiefTut, AnvilEcho, and GhostEcho. Notably, there are code similarities between CharmPower, GorjolEcho, NokNok, and MacDownloader, suggesting these malwares were developed by the same group. Furthermore, Volexity's analysis led to the discovery of the group's newest backdoor, "AnvilEcho," which is considered a successor to previous espionage tools. GreenCharlie, another entity associated with malware, has been linked to POWERSTAR (CharmPower and GorjolEcho) and GORBLE. The functionality of identified NokNok modules mirrors that of the modules associated with CharmPower, with some source code overlaps noted with macOS malware attributed to the group in 2017. These findings provide critical indicators of compromise (IoCs) that can be used to detect and defend against these threats. It is clear from these developments that Charming Kitten is committed to refining its cyber-espionage tactics, making ongoing vigilance and robust cybersecurity measures essential.