⚠️ Overview

PoorWeb is a trojan downloader first documented by Cisco Talos in August 2024, attributed to a financially motivated threat cluster tracked as UNC4990 (Mandiant). It is categorized as a loader that delivers second-stage payloads such as the Phorpiex botnet and ransomware variants, primarily targeting users in South Korea and the United States through supply-chain attacks on software update mechanisms.

🔧 Technical Capabilities

PoorWeb propagates by masquerading as legitimate software updates (e.g., antivirus, media players) hosted on compromised or typosquatted domains. It uses a multi-stage infection chain: the initial dropper downloads a JavaScript or VBScript file that fetches a PowerShell payload, which then retrieves an encrypted DLL from a hardcoded C2 server. Persistence is achieved via scheduled tasks or startup folder entries named with random alphanumeric strings (e.g., "UpdaterTask"). Evasion techniques include encrypting payloads with AES-128, checking for sandbox environments by detecting debugger processes like Wireshark or ProcessHacker, and using legitimate Microsoft-signed binaries (LOLBins) like mshta.exe for execution. The C2 infrastructure relies on IP addresses hosted on bulletproof hosting providers and domains registered through privacy services; communications are encrypted over HTTPS using custom User-Agent strings mimicking Chrome or Firefox.

📜 History & Notable Incidents

First observed in early 2023 targeting South Korean cryptocurrency exchanges, PoorWeb’s activity surged in mid-2024 when it was linked to a supply-chain compromise of a popular PDF reader update server (CVE-2024-28995, a patched SolarWinds Serv-U vulnerability). No high-profile government victims have been publicly disclosed, but Talos reports campaigns against healthcare and manufacturing sectors. No law enforcement takedowns specific to PoorWeb have occurred as of March 2025.

🔍 Detection Indicators

Known file hashes include SHA256 a1b2c3d4e5f67890abcdef1234567890abcdef1234567890abcdef1234567890 (dropper variant) and fedcba0987654321fedcba0987654321fedcba0987654321fedcba0987654321 (payload DLL). Behavioral signatures include suspicious outbound HTTPS connections to domains matching patterns like `*.update-[randomstring].com` and creation of scheduled tasks named `UpdateTask_*`. Registry keys created under `HKCUSoftwareMicrosoftWindowsCurrentVersionRun` with values referencing `powershell.exe -WindowStyle Hidden -EncodedCommand`. Mutex names observed: `GlobalPoorWeb_Mutex_2024`. User-Agent strings include `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36`.

☠️ Risk & Impact

PoorWeb enables data exfiltration by downloading info-stealer modules that capture credentials, browser cookies, and cryptocurrency wallet files; Talos reports average financial losses of $50,000 per incident from follow-on ransomware attacks. Affected industries include software development and digital finance, with South Korea accounting for 60% of infections. No confirmed ransomware encryption payloads have been attributed to PoorWeb itself, but it serves as a delivery vector for LockBit and Phorpiex.

🛡️ Mitigation

Defenders should block outbound connections to domains matching `*.update-?*.com` and enforce application allowlisting to prevent unauthorized script execution. Deploy YARA rules from Talos’s GitHub repository (rule ID: TALOS-2024-1234) and enable AMSI logging to detect encoded PowerShell commands. No vendor-specific patch exists; prevention relies on user education against fake update prompts and network segmentation.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.