Phosphorus APT Deploys Evasive PowerLess PowerShell Backdoor

The Cybereason Nocturnus Team has identified a new toolset attributed to the Iranian state-sponsored group Phosphorus (also known as Charming Kitten or APT35). The campaign leverages the novel 'PowerLess' backdoor, which utilizes a stealthy technique of running PowerShell code within a .NET application context to bypass security products that monitor for the spawning of powershell.exe. This activity follows the exploitation of ProxyShell and Log4j (CVE-2021-44228) vulnerabilities.

Technically, the attack chain is highly modular, featuring multiple stages of AES-encrypted loaders (WindowsProcesses.exe and dll.dll) to deliver the final PowerShell payload. The actor's arsenal also includes browser info stealers, audio recorders, and keyloggers. Notably, infrastructure and TTP overlaps suggest a strong connection between Phosphorus and the Memento ransomware group, which surfaced in late 2021.

This development marks a significant shift in Phosphorus's tradecraft toward more evasive execution methods and potential involvement in financially motivated or destructive ransomware operations. Organizations across critical sectors, particularly in the US, Europe, and the Middle East, remain high-priority targets for these espionage and ransomware-adjacent activities.