Businesses told to guard against PowerPepper Windows exploit

Security researchers have revealed details of a new in-memory Windows backdoor developed by hackers for hire that can execute remote code on targets in Europe, Asia, and the US to steal sensitive data.

This new malware, dubbed PowerPepper, has been credited to hackers-for-hire group DeathStalker. This APT group has been active since 2012 and previously targeted law firms and financial companies in Europe and the Middle East, according to Kaspersky Lab researcher Pierre Delcher.

In a blog post, Delcher said that the new backdoor is designed to execute remote shell commands. The malware will try to evade detection with various tricks, such as detecting mouse movements, filtering the client’s MAC addresses, and adapting its execution flow depending on detected antivirus products.

To launch an attack, DeathStalker usually relies on spear-phishing emails with attachments, or links to public file-sharing services, as well as script execution based on Windows shortcuts. The emails usually involve topics such as carbon emission regulations, travel booking, and the coronavirus pandemic.

The main payload of the malware is hidden in obfuscated content hosted on major public web services like YouTube, Twitter or Reddit; once decoded by malware, this content reveals a command-and-control (C2) server address. The malware also appears to be hidden in a picture of a bunch of peppers, which is where it gets its name.

A loader script extracts the malicious code and, once executed, PowerPepper begins to execute remote shell commands sent by the hackers. These commands are used to steal sensitive business information and carry out reconnaissance.

So far, favoured targets of PowerPepper appear to be firms specialising in law and consultancy, based in Europe, Aisa, and the US.

“The DeathStalker threat is definitely a cause for concern, with the victimology for its various malware strains showing that any corporation or individual in the world can be targeted by their malicious activities, provided someone has decided they are of interest and passed on the word to the threat actor,” said Delcher.

“Luckily for defenders, DeathStalker has, until now, relied on a rather limited set of techniques to design its delivery chains, and implementing counter-measures is an attainable goal for most organizations.”