Powermagic

PowerMagic is a sophisticated malware, also known as DBoxShell, that has been linked to a series of advanced persistent threat (APT) activities. This malicious software was identified by Kaspersky researchers who traced its connections to previous APT activities such as Operation Groundbait, the Prikormka malware (2008-2016), Operation BugDrop (2017), PowerMagic (2020-2022), and CommonMagic (2022). The malware is capable of setting itself up in the system to be persistently launched on startup of the infected device, receiving commands from a remote folder located on public cloud storage, executing these commands, and uploading the results back to the cloud. In March 2023, an unknown APT campaign involving the use of PowerMagic and CommonMagic implants was uncovered in the Russo-Ukrainian conflict region. These attacks were associated with a hacker group named 'Bad Magic', which targeted companies involved in the Russia-Ukrainian conflict. The group executed attacks using a PowerShell-based backdoor called PowerMagic and a new malicious framework named CommonMagic. PowerMagic likely served as a backdoor to deliver the modular CommonMagic framework. Agriculture, administrative, and transportation organizations across Ukrainian regions including Donetsk, Crimea, and Lugansk experienced a sophisticated ongoing attack campaign involving the novel CommonMagic framework and PowerMagic backdoor, as reported in March 2023. The infection began with a decoy document and a malicious LNK file with a double extension used to deploy the PowerMagic backdoor. Subsequent investigations revealed that PowerMagic also deploys a modular framework named CommonMagic, indicating a cluster of more sophisticated malicious activities originating from the same threat actor.