CharmPower

CharmPower, also known as POWERSTAR or GhostEcho, is a PowerShell-based modular backdoor malware attributed to the Iranian hacking group Charming Kitten. This malicious software is designed to infiltrate computer systems, establish persistence, gather information, and execute commands. It was recently updated and distributed via spear-phishing campaigns, exploiting the Log4j vulnerability. These updates were discovered by Volexity, a cybersecurity firm, which noted that Charming Kitten has been evolving their malware in parallel with their spear-phishing techniques. The new version of CharmPower mirrors the functionality of the modules associated with an implant called NokNok, sharing some source code overlaps with macOS malware previously attributed to the group in 2017. The updated version of CharmPower was delivered through targeted spear-phishing campaigns, primarily targeting individuals with ties to the security community and those affiliated with think tanks or universities in Israel, North America, and Europe. Proofpoint, another cybersecurity firm, attributes the attack to the Iranian group with high confidence, based on code similarities between GorjolEcho, NokNok, and malware previously attributed to the group, including GhostEcho, CharmPower, and MacDownloader. In the most recent campaign, the PowerStar malware was delivered via an email containing an .LNK file inside a password-protected .RAR file. This strategy showcases the group's focus on stealth and bespoke attacks to improve the return on investment. Furthermore, Microsoft tracked a group newly designated as Mint Sandstorm using the CharmPower implant. The constant evolution of this malware and its distribution methods highlight the necessity for ongoing vigilance and proactive measures in cybersecurity.