Powermagic

Malware updated 4 days ago (2024-11-29T14:45:46.086Z)
Download STIX
Preview STIX
PowerMagic is a sophisticated malware, also known as DBoxShell, that has been linked to a series of advanced persistent threat (APT) activities. This malicious software was identified by Kaspersky researchers who traced its connections to previous APT activities such as Operation Groundbait, the Prikormka malware (2008-2016), Operation BugDrop (2017), PowerMagic (2020-2022), and CommonMagic (2022). The malware is capable of setting itself up in the system to be persistently launched on startup of the infected device, receiving commands from a remote folder located on public cloud storage, executing these commands, and uploading the results back to the cloud. In March 2023, an unknown APT campaign involving the use of PowerMagic and CommonMagic implants was uncovered in the Russo-Ukrainian conflict region. These attacks were associated with a hacker group named 'Bad Magic', which targeted companies involved in the Russia-Ukrainian conflict. The group executed attacks using a PowerShell-based backdoor called PowerMagic and a new malicious framework named CommonMagic. PowerMagic likely served as a backdoor to deliver the modular CommonMagic framework. Agriculture, administrative, and transportation organizations across Ukrainian regions including Donetsk, Crimea, and Lugansk experienced a sophisticated ongoing attack campaign involving the novel CommonMagic framework and PowerMagic backdoor, as reported in March 2023. The infection began with a decoy document and a malicious LNK file with a double extension used to deploy the PowerMagic backdoor. Subsequent investigations revealed that PowerMagic also deploys a modular framework named CommonMagic, indicating a cluster of more sophisticated malicious activities originating from the same threat actor.
Description last updated: 2024-05-04T16:47:05.308Z
What's your take? (Question 1 of 4)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.
Alias DescriptionVotes
Commonmagic is a possible alias for Powermagic. CommonMagic is a malicious software framework that has been actively used since at least September 2021 to target government, agriculture, and transportation organizations located in the Donetsk, Lugansk, and Crimea regions. It was developed by an APT group linked to the Russo-Ukrainian conflict and
4
Dboxshell is a possible alias for Powermagic. DboxShell is a type of malware that uses cloud storage services as a command and control (C&C) mechanism. It is also known as PowerMagic by Kaspersky. This malicious software infiltrates systems through suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside, it can dis
2
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Backdoor
Kaspersky
Decoy
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.