สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency

Report

Home > List all groups > List all tools > List all groups using tool POWERSTAR

Threat Group Cards: A Threat Actor Encyclopedia

Tool: POWERSTAR

Names	POWERSTAR CharmPower
Category	Malware
Type	Backdoor
Description	(Volexity) Volexity found the latest POWERSTAR variant to be more complex and assesses that it is likely supported by a custom server-side component, which automates simple actions for the malware operator. It is also notable that this latest version of the malware has a variety of interesting features, including the use of the InterPlanetary File System (IPFS), as well as remotely hosting its decryption function and configuration details on publicly accessible cloud hosting.
Information	<https://www.volexity.com/blog/2023/06/28/charming-kitten-updates-powerstar-with-an-interplanetary-twist/> <https://www.volexity.com/blog/2024/02/13/charmingcypress-innovating-persistence/>

Last change to this tool card: 06 March 2024

Download this tool card in JSON format

All groups using tool POWERSTAR

Changed	Name	Country	Observed
APT groups
	Magic Hound, APT 35, Cobalt Illusion, Charming Kitten		2012-Nov 2023

1 group listed (1 APT, 0 other, 0 unknown)

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Report incidents

+66 (0)2-123-1227

[email protected]