Iranian state-sponsored threat actor Educated Manticore has been observed deploying an updated version of PowerLess, a Windows backdoor, to target Israel for phishing attacks, according to a new report by Check Point.
Researchers have also linked Educated Maticore hackers to the Phosphorus APT group, which operates in the Middle East and North America.
“The research presents a new and improved infection chain leading to the deployment of a new version of PowerLess. This implant was attributed to Phosphorus in the past,” Check Point said in its research.
Phosphorus has been active since at least 2017. It has been linked to a series of campaigns in recent years, especially those wherein APT members posed as journalists and scholars to trick targets into installing malware and stealing classified information.
While the PowerLess payload was similar to that deployed by Phosphorus, researchers said there have been improved toolsets used as loading methods.
Educated Manticore uses .Net executables
Educated Manticore in its latest attacks was seen using .Net executables, a rarely used technique.
“The actor has significantly improved its toolset, utilizing rarely seen techniques, most prominently using .Net executables constructed as Mixed Mode Assembly – a mixture of .Net and native C++ code. It improves tools’ functionality and makes the analysis of the tools to be more difficult,” Check Point said in its report.
The hacking group has also started using ISO images. The ISO images used by the threat actor are in English, Arabic, and Hebrew, with academic content about Iraq. Researchers said this suggests, “the targets might have been academic researchers.”
The attack chain uses Iraq-themed lures
The attack chain begins with an ISO image file that makes use of Iraq-themed lures to load a custom in-memory downloader.
The ISO file claims that the academic information is from a nonprofit organization called the Arab Science and Technology Foundation. The ultimate function of the downloader is to install the PowerLess payload.
“PowerLess communication to the server is Base64-encoded and encrypted after obtaining a key from the server. To mislead researchers, the threat actor actively adds three random letters at the beginning of the encoded blob,” Check Point said in its report.
The use of the PowerLess payload by Phosphorus was highlighted by Cybereason in February 2022. The PowerLess payload has the capability to steal data from web browsers and apps like Telegram, take screenshots, record audio, and log keystrokes.
Expect more post-infection activity
Researchers have warned that the updated version of the malware can lead to more post-infection activities.
“Because it is an updated version of previously reported malware, PowerLess, associated with some of Phosphorus’ Ransomware operations, it is important to note that it might only represent the early stages of infection, with significant fractions of post-infection activity yet to be seen in the wild,” Check Point said.
Educated Manticore continues to evolve, refining previously observed toolsets and delivering mechanisms, Check Point said. “The actor is seen adopting popular trends to avoid detection and keeps developing custom toolsets using advanced techniques,” Check Point said in its report.
Copyright © 2023 IDG Communications, Inc.
