PowerLess

Powerless is a malicious software (malware) that was deployed by Ballistic Bobcat in September 2021, during the wrap-up of the campaign documented in CISA Alert AA21-321A. This malware was introduced as part of the PowerLess campaign, which involved the use of a new command and control (C&C) server. The PowerLess backdoor and its supporting toolset were delivered to victims through phishing attacks, often disguised as fake emails. Traditional blocklisting methods proved ineffective against this malware, as the URLs used for downloading additional stages were dynamically generated and the hash of the initial payload fetched from the C2 was always unique. Imperva Data Security Fabric (DSF), a data-centric protection solution for enterprises, was found to be powerless against threats like Powerless. These threats include data handling mistakes, malicious insiders, and attack exploits leveraging compromised account credentials. Despite advancements in law enforcement capabilities, they were unable to act swiftly enough against such cyber threats, particularly those originating from non-cooperative states like Russia. Conventional means also failed to halt the spread of similar malware, such as Glupteba, leading to litigation from companies like Google. Victims of the Powerless malware often felt helpless, witnessing some of their friends and family falling for related scams. Nati Tal, head of Guardio Labs, noted that despite the challenges, they were not entirely powerless, managing to detect millions of fake emails impersonating their brands. Despite these efforts, the culture of blame that often follows such breaches can leave teams feeling powerless. It's crucial to remember that fostering a supportive environment is key to overcoming such cybersecurity challenges.