Charming Kitten Updates POWERSTAR with an Inter Planetary Twist
Summary: Volexity reported on June 28, 2023 that Charming Kitten, an Iran-linked threat actor, used a multi-day spear-phishing exchange impersonating an Israeli media reporter to deliver a password-protected RAR file containing a malicious LNK that installed an updated POWERSTAR backdoor. The new variant retrieves its command-and-control address from the InterPlanetary File System, hosts its decryption function and configuration on public cloud services including Backblaze, and uses AES instead of a custom cipher, with Volexity recovering nine modules, four not previously reported.
Key Takeaway: Because the decryption function is delivered separately from the payload and never written to disk, the attacker holds an effective kill switch that can prevent future analysis of POWERSTAR's key functionality - and the move to IPFS means their C2 file cannot be removed by a third-party provider.
Read the original at Volexity Blog ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026