TEXTMATE

Executive Summary

TextMate is a PowerShell‑based, memory‑resident backdoor linked to FIN7 operations. Deployed after initial exploitation via POWERSOURCE, it establishes covert DNS or web‑based command & control while remaining undetected on disk. The malware is tailored for swift post‑exploitation phases, providing remote execution and data exfiltration capabilities without leaving persistent artifacts.

TextMate is a modular second‑stage backdoor implemented in PowerShell and designed to remain entirely in memory. After initial compromise—typically via an associated loader such as POWERSOURCE—the malware injects itself into a running Windows process, establishing a covert command‑and‑control channel that has been observed using DNS or web protocols under the alias "DNSMessenger." The in‑memory persistence means TextMate leaves no files on disk, reducing the likelihood of traditional signature‑based detection. Operationally, TextMate can execute arbitrary PowerShell scripts, enumerate system information and credentials, download additional payloads over encrypted HTTP/HTTPS connections, and exfiltrate data to an attacker endpoint. Its reliance on built‑in Windows tooling (e.g., WMI, PowerShell remoting) facilitates lateral movement within compromised networks, while its stealthy execution flow allows it to evade many behavioural monitoring solutions. Overall, TextMate represents a sophisticated post‑exploitation tool that combines the flexibility of PowerShell scripting with an aggressive in‑memory design, making it particularly valuable for adversaries like FIN7 seeking rapid, low‑trace footholds in target environments.

Key Capabilities

• In‑memory PowerShell script execution
• Covert DNS/web‑based C&C channel
• System enumeration and credential harvesting
• Encrypted downloading of additional modules
• No disk persistence to avoid file‑based detection
• Supports lateral movement over WMI/SMB or remote PowerShell

ATT&CK Techniques

Recommended Actions

• Block outbound traffic to known malicious domains and IPs used by TextMate
• Restrict PowerShell usage to signed scripts and enable detailed auditing
• Monitor for anomalous in‑memory code injection (e.g., reflective DLL loads)
• Inspect "powershell.exe" processes for non‑standard arguments or hidden execution contexts
• Segment network zones and enforce least privilege to limit lateral movement

Suggested Tags