สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency

Report

Home > List all groups > List all tools > List all groups using tool POWERSTAR

Threat Group Cards: A Threat Actor Encyclopedia

Tool: POWERSTAR

Names	POWERSTAR CharmPower GorjolEcho
Category	Malware
Type	Backdoor
Description	(Volexity) Volexity found the latest POWERSTAR variant to be more complex and assesses that it is likely supported by a custom server-side component, which automates simple actions for the malware operator. It is also notable that this latest version of the malware has a variety of interesting features, including the use of the InterPlanetary File System (IPFS), as well as remotely hosting its decryption function and configuration details on publicly accessible cloud hosting.
Information	<https://www.volexity.com/blog/2023/06/28/charming-kitten-updates-powerstar-with-an-interplanetary-twist/> <https://www.volexity.com/blog/2024/02/13/charmingcypress-innovating-persistence/>
Malpedia	<https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powerstar>

Last change to this tool card: 27 December 2024

Download this tool card in JSON format

Previous: PowerStallion
Next: POWERSTATS

All groups using tool POWERSTAR

Changed	Name	Country	Observed
APT groups
	GreenCharlie		2020
	Magic Hound, APT 35, Cobalt Illusion, Charming Kitten		2012-Aug 2024

2 groups listed (2 APT, 0 other, 0 unknown)

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Report incidents

+66 (0)2-123-1227

[email protected]