Businesses told to guard against PowerPepper Windows exploit

DeathStalker hacking group is using the in-memory backdoor to steal sensitive data

A pile of red chilli peppers on a wooden board

Security researchers have revealed details of a new in-memory Windows backdoor developed by hackers for hire that can execute remote code on targets in Europe, Asia, and the US to steal sensitive data.

This new malware, dubbed PowerPepper, has been credited to hackers-for-hire group DeathStalker. This APT group has been active since 2012 and previously targeted law firms and financial companies in Europe and the Middle East, according to Kaspersky Lab researcher Pierre Delcher.

In a blog post, Delcher said that the new backdoor is designed to execute remote shell commands. The malware will try to evade detection with various tricks, such as detecting mouse movements, filtering the client’s MAC addresses, and adapting its execution flow depending on detected antivirus products.

To launch an attack, DeathStalker usually relies on spear-phishing emails with attachments, or links to public file-sharing services, as well as script execution based on Windows shortcuts. The emails usually involve topics such as carbon emission regulations, travel booking, and the coronavirus pandemic.

The main payload of the malware is hidden in obfuscated content hosted on major public web services like YouTube, Twitter or Reddit; once decoded by malware, this content reveals a command-and-control (C2) server address. The malware also appears to be hidden in a picture of a bunch of peppers, which is where it gets its name.

A loader script extracts the malicious code and, once executed, PowerPepper begins to execute remote shell commands sent by the hackers. These commands are used to steal sensitive business information and carry out reconnaissance.

So far, favoured targets of PowerPepper appear to be firms specialising in law and consultancy, based in Europe, Aisa, and the US.

“The DeathStalker threat is definitely a cause for concern, with the victimology for its various malware strains showing that any corporation or individual in the world can be targeted by their malicious activities, provided someone has decided they are of interest and passed on the word to the threat actor,” said Delcher.

“Luckily for defenders, DeathStalker has, until now, relied on a rather limited set of techniques to design its delivery chains, and implementing counter-measures is an attainable goal for most organizations.”

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Evaluate your order-to-cash process

15 recommended metrics to benchmark your O2C operations

Download now

AI 360: Hold, fold, or double down?

How AI can benefit your business

Download now

Getting started with Azure Red Hat OpenShift

A developer’s guide to improving application building and deployment capabilities

Download now

Recommended

Global ransom DDoS extortionists are retargeting companies
distributed denial of service (DDOS)

Global ransom DDoS extortionists are retargeting companies

22 Jan 2021
Best ransomware removal tools
ransomware

Best ransomware removal tools

22 Jan 2021
Hackers publish over 4,000 files stolen from SEPA in ransomware attack
Security

Hackers publish over 4,000 files stolen from SEPA in ransomware attack

22 Jan 2021
BEC scammers are using Google Forms to identify easy victims
phishing

BEC scammers are using Google Forms to identify easy victims

21 Jan 2021

Most Popular

School laptops sent by government arrive loaded with malware
malware

School laptops sent by government arrive loaded with malware

21 Jan 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

21 Jan 2021
What is the Raspberry Pi Pico?
Hardware

What is the Raspberry Pi Pico?

21 Jan 2021