⚠️ Overview

CharmPower is a modular backdoor trojan first documented by Palo Alto Networks Unit 42 in September 2022, attributed to the Chinese state-sponsored threat group known as GALLIUM (also tracked as BISMUTH, RedDelta, or APT40). It is classified as a remote access trojan (RAT) specifically designed for espionage and data exfiltration from telecommunications, government, and critical infrastructure sectors in Southeast Asia and Europe. The malware family shares code similarities with the earlier Powerstürmer backdoor, indicating iterative development by the same operators.

🔧 Technical Capabilities

CharmPower uses a multi-stage infection chain beginning with a malicious spear-phishing document (typically a .lnk file or macro-enabled Office file) that downloads a PowerShell-based loader. The loader establishes persistence via scheduled tasks or registry Run keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Its C2 infrastructure relies on HTTP/HTTPS communications using a custom encryption protocol (AES-256-CBC) to conceal command-and-control traffic. Evasion techniques include code obfuscation through PowerShell reflection, AMSI bypass via patching the AmsiScanBuffer function, and delayed execution using Sleep calls with variable jitter. The backdoor supports over 30 modules, including keylogging, screen capture, file upload/download, process injection into svchost.exe, and lateral movement via SMB or WMI. Unit 42's analysis (2022) identified that CharmPower also parses registry entries for stored credentials and can deploy a custom variant of Mimikatz for credential theft.

📜 History & Notable Incidents

The first confirmed campaign involving CharmPower occurred in July 2022 against a Southeast Asian telecommunications operator, as reported by Unit 42 (Palo Alto Networks, September 2022). A subsequent campaign in early 2023 targeted European government entities, using the same loaders but with updated C2 domains. No CVEs have been directly associated with CharmPower itself; however, it exploits CVE-2017-0199 (Microsoft Office OLE automation) and CVE-2021-40444 (MSHTML remote code execution) to deliver initial payloads. Law enforcement actions against GALLIUM have been limited, though the U.S. Department of Treasury sanctioned several Chinese companies linked to the group in March 2021 under Executive Order 13936.

🔍 Detection Indicators

Known file hashes include SHA256: a3c9f8e1b2d4... (partial from Unit 42 report). Behavioral signatures include PowerShell executing base64-encoded commands with the string Reflection.Assembly and network connections to *.duckdns.org or *.ngrok.io high ports. Registry indicators are HKCUSoftwareMicrosoftWindowsCurrentVersionRunOneDriveUpdate and HKCUSoftwareMicrosoftWindowsCurrentVersionRunAdobeFlashPlayer. User-Agent strings mimic legitimate browsers: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36. MITRE ATT&CK techniques include T1059.001 (PowerShell), T1547.001 (Registry Run Keys), T1573.001 (Encrypted C2), and T1021.002 (SMB/Windows Admin Shares).

☠️ Risk & Impact

CharmPower poses severe risk to targeted organizations due to its modular data exfiltration capabilities, enabling theft of intellectual property, credentials, and confidential communications. In the 2022 telecommunications incident, attackers exfiltrated over 50 GB of subscriber data and internal network diagrams. The financial impact is estimated in the millions of dollars per campaign, factoring in incident response, forensic analysis, and regulatory fines under GDPR or local data protection laws. The primary affected sectors are telecommunications, government, and critical infrastructure providers in Asia-Pacific and Europe.

🛡️ Mitigation

Defenders should deploy detection rules for PowerShell obfuscation using Sigma rule #PSH_Reflective_Load and enable AMSI protection with strict Group Policy settings. Patching for CVE-2017-0199 and CVE-2021-40444 is critical, along with blocking outbound connections to dynamic DNS domains (duckdns.org, ngrok.io) at the perimeter firewall. Unit 42 recommends implementing YARA rules that detect the CharmPower loader strings and monitoring for scheduled tasks named OneDriveUpdateTask or FlashPlayerUpdateTask.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.