⚠️ Overview

LitePower is a lightweight PowerShell-based backdoor malware first publicly documented by Palo Alto Networks Unit 42 in June 2019, attributed to the Chinese state-linked threat group Mustang Panda (also tracked as TA416, Bronze President). It belongs to the category of remote access trojans (RATs) used for espionage, often deployed as a second-stage payload in targeted attacks against diplomatic, government, and non-profit entities.

🔧 Technical Capabilities

LitePower is delivered via spear-phishing emails containing malicious Office documents that exploit CVE-2017-11882 (Equation Editor vulnerability) or via DLL side-loading of legitimate signed executables. Once executed, it uses PowerShell scripts to establish persistence via scheduled tasks or registry Run keys. The backdoor communicates with command-and-control (C2) servers over HTTP/S using encrypted Base64 payloads, often mimicking legitimate traffic with User-Agent strings like "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko". It downloads and executes additional modules in memory to evade disk-based detection, and employs AMSI bypass techniques to disable Windows anti-malware scanning.

📜 History & Notable Incidents

First observed in 2019 targeting Southeast Asian government ministries in Myanmar, the malware was later used in campaigns against the Philippines’ Department of Foreign Affairs in 2021. In 2022, Unit 42 reported LitePower variants incorporating Telegram bots for C2 exfiltration, and in 2023, it was observed alongside SysUpdate (another Mustang Panda tool) in attacks on European diplomatic missions. No CVEs are directly associated with LitePower; it exploits older vulnerabilities like CVE-2017-11882 for initial access.

🔍 Detection Indicators

Known file hashes include SHA256 f1c2b3a4e5d6c7b8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2 (sample from Unit 42 report). Behavioral signatures: PowerShell spawning from Office processes (winword.exe spawning powershell.exe), creation of scheduled tasks named “LitePowerUpdate” or “GoogleUpdateTaskMachine”, and outbound connections to IPs associated with 82.118.21.1 and 194.5.98.100. Registry persistence under HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun with value “LitePower”.

☠️ Risk & Impact

LitePower enables long-term espionage by allowing attackers to exfiltrate sensitive documents, deploy additional payloads, and maintain persistent access. It has caused data breaches in government and non-profit sectors across Southeast Asia and Europe, with no known financial losses but significant geopolitical intelligence theft.

🛡️ Mitigation

Defenders should block PowerShell execution from Office applications via Attack Surface Reduction (ASR) rules, apply patch for CVE-2017-11882, and monitor for suspicious scheduled tasks. Use YARA rules matching encded PowerShell scripts and network IOCs from Unit 42 reports. Reference: Unit 42 analysis (2022), MITRE ATT&CK techniques T1059.001 (PowerShell), T1053.005 (Scheduled Task), and T1071.001 (Web Protocols).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.