Cybersecurity firm SafeBreach has issued a warning about a new PowerShell backdoor that disguises itself as part of the Windows update process to remain fully undetected.

Operated by a sophisticated, unknown threat actor, the backdoor is distributed via a malicious Word document that appears linked to a LinkedIn-based job application spear-phishing lure.

When the document is opened, macro code inside it drops a PowerShell script on the victim’s machine, creates a scheduled task claiming to be part of a Windows update, and then executes the script from a fake update folder.

The script was designed to execute another PowerShell script but, before the scheduled task is executed, two other scripts are dropped on the system.

“The content of the PowerShell scripts is stored in text boxes inside the Word document and will be saved to the same fake update directory,” SafeBreach said in a note documenting the threat.

While analyzing the two scripts, the company’s researchers discovered that some coding errors could allow them to determine the potential number of victims: one of the scripts was likely installed on more than 70 systems, while the other likely had over 50 installations.

SafeBreach says that the attackers used the scripts to execute specific commands for information gathering, local user enumeration, file listing, file deletion, and Active Directory user enumeration.

SafeBreach has published indicators of compromise (IoCs) associated with this PowerShell backdoor and warns that it is fully undetectable.

By Ionut Arghire on Wed, 19 Oct 2022 21:55:38 +0000
Original link