Powerless Backdoor

The PowerLess Backdoor is a novel and previously undocumented malware linked to the Phosphorus group, an Iranian-aligned threat actor. This malicious software was discovered by the Cybereason Nocturnus Team in September 2021 when a victim received an updated version of the Ballistic Bobcat tools, which included this backdoor and its supporting toolset. The malware is installed via a compromised Windows version of a virtual private network (VPN) application, using PowerShell to enable file transfer and execution. This sophisticated backdoor has various capabilities that pose significant threats to the infected systems. It targets specific data on the system, logs keystrokes, captures screenshots, and can execute commands after decrypting multiple AES encrypted layers. The PowerLess Backdoor's unique feature is its ability to spawn powershell.exe, a command-line shell and scripting language designed for system administration and automation. Recently, a new Iranian-aligned threat actor named Educated Manticore has been found using new tactics and tools, including an updated version of the PowerLess Backdoor, targeting entities in Israel. This development highlights the continuous evolution and sophistication of cyber threats, emphasizing the need for robust cybersecurity measures to protect against such advanced persistent threats.