Powerstar

Powerstar is a malicious software (malware) utilized by the Iranian state-sponsored threat operation, Charming Kitten, also known as APT35, Mint Sandstorm, Cobalt Illusion, and Yellow Garuda. This malware has been deployed in spear-phishing attacks targeting US political and government entities since May 2023, according to The Hacker News. Powerstar, which is also referred to as CharmPower and GorjolEcho, is part of a family of malware that includes GORBLE, both of which are designed to enable espionage activities via spear-phishing campaigns. Charming Kitten's operations are sophisticated, leveraging phishing and malware deployment strategies. GreenCharlie, associated with Charming Kitten, uses malware like Powerstar and GORBLE in multi-stage infection processes to compromise systems. These tools assist the backdoor operator by automating basic tasks, making the cyber-espionage more efficient. Notably, Powerstar has undergone updates to enhance its capabilities, as reported by BankInfoSecurity. The malware Powerstar should not be confused with the Chinese PC Maker Powerstar, which rebranded an Intel CPU as the P3-01105, as noted by Tom's Hardware. In addition, different cybersecurity firms have their own names for these threats; Proofpoint refers to Powerstar as "GorjolEcho," while Volexity researchers use the term "PowerStar" to describe a particular Windows code payload used in these campaigns. Most recently, Volexity highlighted the adversary's use of an updated version of a Powershell implant called CharmPower, also known as GhostEcho or Powerstar.