Businesses told to guard against PowerPepper Windows exploit

DeathStalker hacking group is using the in-memory backdoor to steal sensitive data

A pile of red chilli peppers on a wooden board

Security researchers have revealed details of a new in-memory Windows backdoor developed by hackers for hire that can execute remote code on targets in Europe, Asia, and the US to steal sensitive data.

This new malware, dubbed PowerPepper, has been credited to hackers-for-hire group DeathStalker. This APT group has been active since 2012 and previously targeted law firms and financial companies in Europe and the Middle East, according to Kaspersky Lab researcher Pierre Delcher.

In a blog post, Delcher said that the new backdoor is designed to execute remote shell commands. The malware will try to evade detection with various tricks, such as detecting mouse movements, filtering the client’s MAC addresses, and adapting its execution flow depending on detected antivirus products.

To launch an attack, DeathStalker usually relies on spear-phishing emails with attachments, or links to public file-sharing services, as well as script execution based on Windows shortcuts. The emails usually involve topics such as carbon emission regulations, travel booking, and the coronavirus pandemic.

The main payload of the malware is hidden in obfuscated content hosted on major public web services like YouTube, Twitter or Reddit; once decoded by malware, this content reveals a command-and-control (C2) server address. The malware also appears to be hidden in a picture of a bunch of peppers, which is where it gets its name.

A loader script extracts the malicious code and, once executed, PowerPepper begins to execute remote shell commands sent by the hackers. These commands are used to steal sensitive business information and carry out reconnaissance.

So far, favoured targets of PowerPepper appear to be firms specialising in law and consultancy, based in Europe, Aisa, and the US.

“The DeathStalker threat is definitely a cause for concern, with the victimology for its various malware strains showing that any corporation or individual in the world can be targeted by their malicious activities, provided someone has decided they are of interest and passed on the word to the threat actor,” said Delcher.

“Luckily for defenders, DeathStalker has, until now, relied on a rather limited set of techniques to design its delivery chains, and implementing counter-measures is an attainable goal for most organizations.”

Featured Resources

Consumer choice and the payment experience

A software provider's guide to getting, growing, and keeping customers

Download now

Prevent fraud and phishing attacks with DMARC

How to use domain-based message authentication, reporting, and conformance for email security

Download now

Business in the new economy landscape

How we coped with 2020 and looking ahead to a brighter 2021

Download now

How to increase cyber resilience within your organisation

Cyber resilience for dummies

Download now

Recommended

X-rated phishing attacks just keep growing
phishing

X-rated phishing attacks just keep growing

4 Jun 2021
Nigerian cyber criminals target Texas unemployment system
cyber security

Nigerian cyber criminals target Texas unemployment system

27 May 2021
Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021
eBay, Apple, Microsoft, Facebook, and Google were phishers’ top targets in 2020
phishing

eBay, Apple, Microsoft, Facebook, and Google were phishers’ top targets in 2020

20 Apr 2021

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

16 Jun 2021
What is HTTP error 400 and how do you fix it?
Network & Internet

What is HTTP error 400 and how do you fix it?

16 Jun 2021
EU plans to launch bloc-wide cyber task force
cyber attacks

EU plans to launch bloc-wide cyber task force

22 Jun 2021