PowerLess

Powerless is a malware that was deployed by Ballistic Bobcat in September 2021, as they were concluding the campaign documented in CISA Alert AA21-321A and the PowerLess campaign. The malware was introduced through a new backdoor, exploiting gaps left by traditional security measures which are often incapable of dealing with such sophisticated threats. Ballistic Bobcat also utilized the Command & Control (C&C) infrastructure from the PowerLess campaign, in addition to introducing a new C&C server. This allowed for the delivery of the next generation of Ballistic Bobcat tools, including the PowerLess backdoor and its supporting toolset. The PowerLess malware proved particularly challenging to combat due to its unique characteristics. The URLs used for downloading additional stages were dynamically generated, making it difficult to predict or block them. Furthermore, the hash of the initial payload fetched from the C2 was always unique, rendering standard blocklisting methods ineffective. Other phishing attacks launched by Charming Kitten distributed the PowerLess and NOKNOK backdoors, demonstrating the widespread impact of this malicious software. Despite improvements in law enforcement capabilities, agencies struggled to respond swiftly enough to the PowerLess threat. They were also hindered by uncooperative states like Russia, highlighting the international challenges in combating cybercrime. Traditional means were powerless against the PowerLess malware, leading to unconventional approaches such as litigation from Google against Glupteba, another malware that had grown significantly large. Overall, the PowerLess malware represents a significant and evolving threat in the cybersecurity landscape.