PowerExchange

Executive Summary

OilRig’s PowerExchange is a sophisticated PowerShell backdoor that delivers persistent footholds in targeted Middle Eastern government networks. It leverages standard Windows persistence mechanisms and encrypted C2 traffic to evade detection while exfiltrating credentials, documents, and system information.

PowerExchange is a malicious PowerShell-based backdoor that has been identified as part of the OilRig cyber espionage campaign, active against government entities in the Middle East since at least 2023. The malware arrives via spear‑phishing attachments or compromised web sites, delivering a shell script that invokes an obfuscated PowerShell payload. Once executed it establishes persistence by creating scheduled tasks and adding entries to the HKLM\Software\Microsoft\Windows\CurrentVersion\Run hive, ensuring the backdoor restarts across reboots. Operationally, PowerExchange uses a custom command‑and‑control (C2) channel over HTTPS with dynamic certificates. It receives encrypted instructions encoded in base64, executes arbitrary PowerShell commands, and exfiltrates data such as keystrokes, screenshots, clipboard contents, and Windows credentials gathered by third‑party modules. The use of native Windows tools, combined with PowerShell for all stages (execution, delivery, persistence, lateral movement), makes detection challenging; however, its reliance on well‐known Office macros and scheduled task creation can be leveraged to build detection rules. The malware’s impact is primarily stealthy data theft and lateral spread within internal networks rather than ransomware or destructive payloads.

Key Capabilities

• Obfuscated PowerShell execution
• Creates scheduled tasks and registry Run keys for persistence
• Establishes HTTPS-based command‑and‑control with dynamic certificates
• Decodes base64‑encoded instructions and executes arbitrary PowerShell commands
• Exfiltrates sensitive data including screenshots, clipboard, keystrokes, and credentials

ATT&CK Techniques

Recommended Actions

• Enable Windows PowerShell script block logging and transcription to capture payload activity
• Implement AppLocker or Software Restriction Policies to block untrusted executables and restrict PowerShell scripts based on signatures
• Continuously monitor for new scheduled tasks and changes to the HKLM\Software\Microsoft\Windows\CurrentVersion\Run hive
• Deploy network monitoring rules that flag unexplained outbound HTTPS traffic from legitimate processes to unknown domains
• Maintain up‑to‑date endpoint protection with behavior analytics focused on PowerShell reconnaissance

Suggested Tags