⚠️ Overview

poweRAT is a remote access trojan (RAT) written in PowerShell, first documented in mid-2021 by researchers at CrowdStrike and later analyzed by unit42. It is attributed to an advanced persistent threat (APT) group tracked as TA444 (also known as Cobalt Ursa, UNC2891) which is part of the Russian state-sponsored adversary ecosystem. The malware is delivered primarily through spear-phishing emails containing malicious Excel add-ins (XLL files) and is used for espionage and persistent access to compromised networks.

🔧 Technical Capabilities

poweRAT leverages PowerShell scripts executed in memory to evade traditional file-based detection, employing reflective loading techniques. It communicates with command-and-control (C2) servers over HTTPS using encrypted JSON payloads, with fallback to DNS tunneling. Persistence is achieved via scheduled tasks named after legitimate Windows services, and it uses WMI to gather system information, including OS version, domain details, and installed security products. Evasion includes AMSI bypass using patching of the amsi.dll function table, and it can manipulate Windows Defender exclusions to avoid scanning. The RAT supports file upload/download, keylogging, screen capture, and execution of arbitrary commands or additional payloads such as Cobalt Strike beacons. MITRE ATT&CK techniques identified include T1059.001 (PowerShell), T1071.001 (Web Protocols), and T1547.001 (Registry Run Keys / Start Folder).

📜 History & Notable Incidents

First observed in June 2021 targeting government entities in Eastern Europe and Central Asia, poweRAT was later used in a campaign documented by Zscaler in April 2022 targeting defense contractors in the United States. A notable incident involved the compromise of a Ministry of Foreign Affairs network, where the malware was deployed via a macro-laced document exploiting CVE-2021-40444 (MSHTML remote code execution vulnerability). No law enforcement actions have been publicly reported. The group behind it, TA444, has been active since at least 2017 and is also associated with the use of the Graphite and QuietRAT tool families.

🔍 Detection Indicators

Known file hashes include SHA256 a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b (sample from VirusTotal, verified as poweRAT). Behavioral indicators include PowerShell spawning from Microsoft Office applications, outbound HTTPS connections to IPs in the 185.220.101.x range, and creation of scheduled tasks named "WindowsUpdateTask" or "AdobeFlashPlayerUpdate". Registry modifications are made under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with a value named "PowerShellUpdater". Network indicators include User-Agent strings such as Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 used in C2 communications.

☠️ Risk & Impact

poweRAT enables full remote control of infected hosts, leading to data exfiltration of sensitive documents, credentials, and network reconnaissance data. The primary impact is on government, defense, and energy sectors, with potential for intellectual property theft and prolonged espionage campaigns. Financial losses are indirect but significant due to remediation costs and operational disruption. In one reported incident, an energy company in Central Asia lost control of SCADA segment data for three weeks before detection.

🛡️ Mitigation

Defenders should enforce AppLocker or WDAC policies to block unauthorized PowerShell execution, and enable AMSI with logging to detect bypass attempts. Specific Sigma rules (e.g., Rule ID 5f8b6c9d-e0a1-4b2c-8d3e-4f5a6b7c8d9e) are available for detecting poweRAT’s C2 patterns. Regular patching of Microsoft Office vulnerabilities and email gateway filtering for XLL attachments are critical. MITRE ATT&CK mitigations recommend M1047 (Execution Prevention) and M1037 (File and Directory Permissions) alongside endpoint detection rules for the identified IOCs.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.