Cybersecurity firm SafeBreach has issued a warning about a new PowerShell backdoor that disguises itself as part of the Windows update process to remain fully undetected.
Operated by a sophisticated, unknown threat actor, the backdoor is distributed via a malicious Word document that appears linked to a LinkedIn-based job application spear-phishing lure.
When the document is opened, macro code inside it drops a PowerShell script on the victim’s machine, creates a scheduled task claiming to be part of a Windows update, and then executes the script from a fake update folder.
The script was designed to execute another PowerShell script but, before the scheduled task is executed, two other scripts are dropped on the system.
“The content of the PowerShell scripts is stored in text boxes inside the Word document and will be saved to the same fake update directory,” SafeBreach said in a note documenting the threat.
While analyzing the two scripts, the company’s researchers discovered that some coding errors could allow them to determine the potential number of victims: one of the scripts was likely installed on more than 70 systems, while the other likely had over 50 installations.
SafeBreach says that the attackers used the scripts to execute specific commands for information gathering, local user enumeration, file listing, file deletion, and Active Directory user enumeration.
SafeBreach has published indicators of compromise (IoCs) associated with this PowerShell backdoor and warns that it is fully undetectable.
Related: Seven ‘Creepy’ Backdoors Used by Lebanese Group in Israel Attacks
Related: New Cyberespionage Group ‘Worok’ Targeting Entities in Asia
Related: Brute Force Attacks Against SQL Servers Use PowerShell Wrapper

More from Ionut Arghire
- New York Attorney General Fines Vendor for Illegally Promoting Spyware
- 20 Million Users Impacted by Data Breach at Instant Checkmate, TruthFinder
- Florida Hospital Cancels Procedures, Diverts Patients Following Cyberattack
- Former Ubiquiti Employee Who Posed as Hacker Pleads Guilty
- Atlassian Warns of Critical Jira Service Management Vulnerability
- Exploitation of Oracle E-Business Suite Vulnerability Starts After PoC Publication
- Google Shells Out $600,000 for OSS-Fuzz Project Integrations
- F5 BIG-IP Vulnerability Can Lead to DoS, Code Execution
Latest News
- Comcast Wants a Slice of the Enterprise Cybersecurity Business
- Critical Baicells Device Vulnerability Can Expose Telecoms Networks to Snooping
- New York Attorney General Fines Vendor for Illegally Promoting Spyware
- SecurityWeek Analysis: Over 450 Cybersecurity M&A Deals Announced in 2022
- 20 Million Users Impacted by Data Breach at Instant Checkmate, TruthFinder
- Cyber Insights 2023 | Zero Trust and Identity and Access Management
- Cyber Insights 2023 | The Coming of Web3
- European Police Arrest 42 After Cracking Covert App
