PowerPepper Backdoor
PowerPepper is an advanced backdoor implant used but the DeathStalker APT group for use as a first-stage implant in attacks against banking, financial technology, and government organisations globally.
Summary
PowerPepper is an advanced backdoor implant used but the DeathStalker APT group for use as a first-stage implant in attacks against banking, financial technology, and government organisations globally.
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
First observed in early May 2020, PowerPepper is a fileless PowerShell backdoor created by the DeathStalker advanced persistent threat group for use in their own campaigns.
Delivery
PowerPepper is delivered in two distinct methods, both of which are believed tor begin with a spear-phishing email. The first method uses a malicious Microsoft Word document sent either as an attachment or downloaded via LNK file in the email. When opened, several VBA macros within the document are executed and in turn decrypt an embedded PNG file containing a steganographically hidden PowerPepper payload. A second macro then executes this directly in-memory.
Newer PowerPepper infections discard the VAB macros, instead using PowerShell scripts directly embedded in the LNK file. These scripts then pull a number of JPG and PNG files, again containing steganographically hidden PowerPepper payloads, from the Word document.
Activities
Once delivered, PowerPepper will gather system and user information before sending it to a command and control (C2) server using DNS over HTTPS (DoH) using Cloudflare's 1.1.1.1 resolver. Interestingly, PowerPepper will attempt to use Microsoft Excel as a web client, before falling back to the PowerShell client if it can't.
Once successfully connected to a C2 server, PowerPepper drops a keylogger as well as a MAC address filtering module. It can also execute secondary PowerShell scripts in order to download and install new payloads.
Remediation advice
To prevent and detect an infection, NHS Digital advises that:
- Secure configurations are applied to all devices.
- Security updates are applied at the earliest opportunity.
- Tamper protection settings in security products are enabled where available.
- Obsolete platforms are segregated from the rest of the network.
- IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
- Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
- Administrative accounts are only used for necessary purposes.
- Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
- Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.
Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.
Indicators of compromise
Last edited: 10 December 2020 4:24 pm