POWERSOURCE

Executive Summary

POWERSOURCE is a PowerShell backdoor used in targeted spearphishing campaigns against SEC filing personnel. It delivers an obfuscated payload via Office macros and employs DNS‑TXT queries for resilient command‑and‑control and data exfiltration, enabling stealthy persistence, credential theft, and remote execution.

POWERSOURCE, also known as DNSMessenger, is a PowerShell‑based backdoor that originated from an obfuscated, heavily modified version of the publicly available tool DNS_TXT_Pwnage. The malware was first documented in February 2017 and was employed in spearphishing campaigns targeting personnel involved with United States Securities and Exchange Commission (SEC) filings at various organizations. Delivery is achieved through compromised Office documents that contain malicious macros; once enabled, a short VBS script is dropped to the victim’s system. That script serves as an installer for the PowerShell component, which becomes the primary agent. The backdoor leverages a DNS‑TXT query–based command‑and‑control channel, allowing remote operators to issue arbitrary commands and exfiltrate data with minimal network footprint. POWERSOURCE is designed to evade static analysis through layered obfuscation—variable renaming, code splitting, and encryption of script payloads. It also includes mechanisms for persistence (e.g., registry Run keys or scheduled tasks) and performs credential harvesting via standard Windows credential dumping techniques. Operationally, the attacker can remotely execute PowerShell commands, harvest system information, capture network traffic, and exfiltrate collected data back through DNS TXT records or other encrypted channels. The malware’s stealthy design, coupled with its focus on high‑value targets (SEC filing staff), made it a notable example of state‑oriented, targeted intrusion activity during the 2017 threat landscape.

Key Capabilities

• PowerShell-based backdoor delivering commands remotely
• Obfuscated code designed to evade detection and analysis
• DNS TXT record queries used for C2 communication and data exfiltration
• Drops a VBS script when Office macros are enabled to install the agent
• Creates persistence via registry Run keys or scheduled tasks
• Harvests credentials using local Windows credential dumping techniques
• Collects system information and logs
• Encodes exfiltrated data with encryption before transmitting

ATT&CK Techniques

Recommended Actions

• Enforce strict macro security policies and disable automatic execution of Office documents from untrusted sources.
• Deploy endpoint detection that flags obfuscated PowerShell scripts and detects suspicious DNS TXT query patterns.
• Implement network monitoring to detect anomalous outbound DNS traffic, especially TXT record requests to unfamiliar domains.
• Use application whitelisting or controls to block unsigned PowerShell and VBS executions not signed by trusted vendors.
• Update Microsoft Office and Windows with the latest security patches to mitigate macro‑related vulnerabilities.
• Conduct targeted phishing awareness training for staff involved in SEC filings and other high‑value roles.
• Consider deploying DNS filtering and threat intelligence feeds to block known malicious C2 domains used by POWERSOURCE.

Suggested Tags