MITRE ATT&CKsoftware (malware)

S0371 POWERTON

Published 2019-04-16 Modified 2025-04-25 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.1
Created
2019-04-16

Description

POWERTON is a custom PowerShell backdoor first observed in 2018. It has typically been deployed as a late-stage backdoor by APT33. At least two variants of the backdoor have been identified, with the later version containing improved functionality.

Related

Uses · MITRE ATT&CK (6)

  • T1573.001 Symmetric Cryptography sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1059.001 PowerShell sub-technique
  • T1003.002 Security Account Manager sub-technique
  • T1546.003 Windows Management Instrumentation Event Subscription sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique

Referenced by MITRE ATT&CK · uses (1)

References