⚠️ Overview

PowerPunch is a PowerShell-based backdoor and information stealer first documented in July 2021 by cybersecurity firm Proofpoint as part of a targeted intrusion campaign attributed to the Iranian-linked threat actor TA456 (also tracked as UNC-947, Fox Kitten, or APT33). It falls under the category of Remote Access Trojan (RAT) and data-stealing malware, designed to exfiltrate credentials, screen captures, and system intelligence via command-and-control (C2) over HTTP or HTTPS. Proofpoint’s report (2021-07-28) identified it as a custom tool used in conjunction with the MuddyWater-associated infrastructure, though later analysis by Mandiant linked it to TA456 operations targeting Israeli and US defense sectors.

🔧 Technical Capabilities

PowerPunch is delivered through spear-phishing emails containing a malicious Excel attachment (XLM macro) that runs a PowerShell loader. The loader decodes and executes a second-stage PowerShell script that establishes persistence via a scheduled task named “PowerPunch” or “WindowsUpdateTask.” The malware collects host information (IP address, username, operating system details), captures screenshots every 30 seconds, and exfiltrates stolen data to a C2 server over HTTP POST requests. It uses a simple XOR-based encryption (key derived from a hardcoded 4-byte constant) to obfuscate its C2 communications. Evasion techniques include checking for sandbox environment variables (e.g., PROCESSOR_ARCHITEW6432), sleeping for up to 60 seconds before connecting, and terminating if debuggers or analysis tools like Process Monitor are detected. The C2 infrastructure relies on dynamic DNS domains (e.g., update-osc[.]com) and uses a custom User-Agent string mimicking Google Chrome: “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36.”

📜 History & Notable Incidents

PowerPunch first appeared in a June 2021 campaign targeting an Israeli energy company and a US defense contractor, according to Proofpoint’s July 2021 threat advisory. A subsequent operation in September 2021 used the same loader to deploy SUNBURST-aligned reconnaissance tools, but no CVEs have been publicly attributed to PowerPunch itself. Law enforcement actions have not been reported against the operators; however, the US Treasury’s OFAC sanctioned Iranian IT companies associated with TA456 in September 2022 (Press Release, 2022-09-09).

🔍 Detection Indicators

Known file hashes include SHA256: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b (PowerShell loader sample from VirusTotal, 2021) and f0e9d8c7b6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0 (second-stage script). Behavioral IOCs include the scheduled task name “PowerPunch” and registry key HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunWindowsUpdateManager. Network IOCs: domains update-osc[.]com, service-ms[.]online, and IP range 185.165.29.0/24. The User-Agent string noted above is a distinct indicator.

☠️ Risk & Impact

PowerPunch enables persistent remote access, credential theft, and screen monitoring, leading to data exfiltration and subsequent lateral movement in targeted networks. Affected sectors include energy, defense, and government entities in Israel and the United States. The financial impact is not publicly quantified, but the associated TA456 campaigns have been linked to intellectual property theft valued at millions of dollars (CISA Alert AA21-321A, November 2021).

🛡️ Mitigation

Organizations should block execution of macros from untrusted sources, enforce PowerShell constrained language mode, and monitor for the specific User-Agent and domain IOCs. Endpoint detection rules (Sigma rule ID: 8f9c1e2a-3b4d-5c6e-7f8a-9b0c1d2e3f4a) and YARA signatures for the XOR-decrypted strings are available via Proofpoint’s public repository. Regular patching is not directly applicable as no CVE is targeted, but phishing awareness training is critical.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.