Businesses told to guard against PowerPepper Windows exploit

DeathStalker hacking group is using the in-memory backdoor to steal sensitive data

A pile of red chilli peppers on a wooden board

Security researchers have revealed details of a new in-memory Windows backdoor developed by hackers for hire that can execute remote code on targets in Europe, Asia, and the US to steal sensitive data.

This new malware, dubbed PowerPepper, has been credited to hackers-for-hire group DeathStalker. This APT group has been active since 2012 and previously targeted law firms and financial companies in Europe and the Middle East, according to Kaspersky Lab researcher Pierre Delcher.

In a blog post, Delcher said that the new backdoor is designed to execute remote shell commands. The malware will try to evade detection with various tricks, such as detecting mouse movements, filtering the client’s MAC addresses, and adapting its execution flow depending on detected antivirus products.

To launch an attack, DeathStalker usually relies on spear-phishing emails with attachments, or links to public file-sharing services, as well as script execution based on Windows shortcuts. The emails usually involve topics such as carbon emission regulations, travel booking, and the coronavirus pandemic.

The main payload of the malware is hidden in obfuscated content hosted on major public web services like YouTube, Twitter or Reddit; once decoded by malware, this content reveals a command-and-control (C2) server address. The malware also appears to be hidden in a picture of a bunch of peppers, which is where it gets its name.

A loader script extracts the malicious code and, once executed, PowerPepper begins to execute remote shell commands sent by the hackers. These commands are used to steal sensitive business information and carry out reconnaissance.

So far, favoured targets of PowerPepper appear to be firms specialising in law and consultancy, based in Europe, Aisa, and the US.

“The DeathStalker threat is definitely a cause for concern, with the victimology for its various malware strains showing that any corporation or individual in the world can be targeted by their malicious activities, provided someone has decided they are of interest and passed on the word to the threat actor,” said Delcher.

“Luckily for defenders, DeathStalker has, until now, relied on a rather limited set of techniques to design its delivery chains, and implementing counter-measures is an attainable goal for most organizations.”

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Evaluate your order-to-cash process

15 recommended metrics to benchmark your O2C operations

Download now

AI 360: Hold, fold, or double down?

How AI can benefit your business

Download now

Getting started with Azure Red Hat OpenShift

A developer’s guide to improving application building and deployment capabilities

Download now

Recommended

FBI warns of ongoing corporate vishing attacks
phishing

FBI warns of ongoing corporate vishing attacks

19 Jan 2021
How LogPoint uses MITRE ATT&CK
Whitepaper

How LogPoint uses MITRE ATT&CK

15 Jan 2021
How LogPoint uses MITRE ATT&CK
Whitepaper

How LogPoint uses MITRE ATT&CK

15 Jan 2021
How LogPoint uses MITRE ATT&CK
Whitepaper

How LogPoint uses MITRE ATT&CK

15 Jan 2021

Most Popular

IT retailer faces €10.4m GDPR fine for employee surveillance
General Data Protection Regulation (GDPR)

IT retailer faces €10.4m GDPR fine for employee surveillance

18 Jan 2021
Citrix buys Slack competitor Wrike in record $2.25bn deal
collaboration

Citrix buys Slack competitor Wrike in record $2.25bn deal

19 Jan 2021
Should IT departments call time on WhatsApp?
communications

Should IT departments call time on WhatsApp?

15 Jan 2021