สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency

Report

Home > List all groups > List all tools > List all groups using tool POWERSTAR

Threat Group Cards: A Threat Actor Encyclopedia

Tool: POWERSTAR

Names	POWERSTAR CharmPower GorjolEcho
Category	Malware
Type	Backdoor
Description	(Volexity) Volexity found the latest POWERSTAR variant to be more complex and assesses that it is likely supported by a custom server-side component, which automates simple actions for the malware operator. It is also notable that this latest version of the malware has a variety of interesting features, including the use of the InterPlanetary File System (IPFS), as well as remotely hosting its decryption function and configuration details on publicly accessible cloud hosting.
Information	<https://www.volexity.com/blog/2023/06/28/charming-kitten-updates-powerstar-with-an-interplanetary-twist/> <https://www.volexity.com/blog/2024/02/13/charmingcypress-innovating-persistence/>

Last change to this tool card: 23 October 2024

Download this tool card in JSON format

All groups using tool POWERSTAR

Changed	Name	Country	Observed
APT groups
	GreenCharlie		2020
	Magic Hound, APT 35, Cobalt Illusion, Charming Kitten		2012-Aug 2024

2 groups listed (2 APT, 0 other, 0 unknown)

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Report incidents

+66 (0)2-123-1227

[email protected]