Educated Manticore is an Iran-aligned threat cluster that has evolved its toolset to deploy a newer PowerLess variant via ISO-based lures targeting Israel. The operation uses a multi-stage infection chain with a mixed-mode .NET loader and in-memory execution to bypass defenses and fetch additional payloads from attacker-controlled domains. #EducatedManticore #PowerLess #Phosphorus #Israel #Iraq
Keypoints
- Educated Manticore is an Iranian-aligned activity cluster closely related to Phosphorus.
- Actors use ISO images and PDFs with Iraq- and Israel-focused lures to initiate infections.
- PowerLess is updated to employ a .NET mixed-mode assembly with heavy obfuscation and RunPE-In-Memory.
- The infection chain involves lure ISO, an Initial Loader, a Downloader, a PowerLess Loader, and a PowerLess Payload.
- The PowerLess Loader implements AMSI and ETW bypasses and downloads the next stages from attacker-controlled domains.
- The PowerLess payload expands capabilities (system discovery, process/file listing, Telegram data theft, screenshots, and a keylogger module).
MITRE Techniques
- [T1566.001] Phishing – Use of an ISO file to initiate infection chains after user interaction. Quote: ‘The ISO file is designed to deceive the user.’
- [T1105] Ingress Tool Transfer – Downloader downloads PowerLess loader and encrypted PowerShell payload from attacker-controlled domain. Quote: ‘Downloads the PowerLess loader through a POST request to an attacker-controlled domain … downloading the encrypted PowerShell payload content through a POST request to the same server.’
- [T1059.001] PowerShell – LNK triggers a PowerShell script to extract and run a PE file. Quote: ‘Clicking the malicious LNK file triggers a PowerShell script that extracts a PE file embedded within it, saving it to the %temp% folder.’
- [T1027] Obfuscated/Compressed Files and Information – Initial loader is obfuscated with pattern-based obfuscation and 13 customized string-decryption functions TEA32. Quote: ‘The initial loader is obfuscated, most likely with compiler-generated pattern-based obfuscation. … 13 customized string-decryption functions that are based on TEA32.’
- [T1140] Deobfuscate/Decode Files or Information – Decrypts downloader contents from zoom.jpg using AES-256-CBC with a key and IV. Quote: ‘Decrypts the contents of the downloader to memory from zoom.jpg using AES-256-CBC with the KEY …’
- [T1055] Process Injection – RunPE-In-Memory is used to decrypt and execute payload in memory. Quote: ‘using RunPE-In-Memory … mapped to memory, and execute it at its entry point.’
- [T1562.001] Impair Defenses: AMSI Bypass – Loader performs AMSI Bypass (and ETW Bypass) evasion. Quote: ‘a few evasion techniques, AMSI Bypass and ETW Bypass.’
- [T1547.001] Registry Run Keys/Startup Folder – Persistence via registry key to load syscall01.exe. Quote: ‘Creates the directory … Copies itself with the name syscall01.exe to the above folder … Constructs the path to the file zoom.jpg …’
- [T1071.001] Web Protocols – C2 communications with base64-encoded data and encrypted payloads over attacker-controlled domains. Quote: ‘PowerLess C&C communication to the server is Base64-encoded and encrypted after obtaining a key from the server.’
- [T1082] System Information Discovery – Backdoor enumerates the system and sends recon data (computer name, username, OS, IP, etc.). Quote: ‘the PowerShell backdoor enumerates the system and sends recon data … including the computer name, username, operating system, IP address, installation path, computer manufacturer, and security software installed.’
- [T1056] Input Capture: Keylogging – PowerLess can download a keylogger module. Quote: ‘including a keylogger, browser information stealer, and a surroundings sound recorder.’
Indicators of Compromise
- [Domain] C2 domains – subinfralab.info, deersharpfork.info, and blackturtle.hopto.org
- [Hashes] Archives – 3e1ed006e120a1afaa49f93b4156a992f8d799b1888ca6202c1098862323c308 29318f46476dc0cfd7b928a2861fea1b761496eb5d6a26040e481c3bd655051a and 4 more hashes
- [Hashes] PE files – e5ba06943abb666f69f757fcd591dd1cceb66cad698fb894d9bc8911282198c4 97a615e69c38db9dffda6be7c11dd27547ce4036a4998a1469fa81b548c6f0b0 and 7 more hashes
- [Hashes] LNK – 1672a14a3e54a127493a2b8257599c5582204846a78521b139b074155003cba4 and 0f4d309f0145324a6867108bb04a8d5d292e7939223d6d63f44e21a1ce45ce4
- [Hashes] PowerShell – 737cb075ba0b5ed6d8901dcd798eecff0bc8585091bc232c54f92df7f9e9e817 and cd813d56cf9f2201a2fa69e77fb9acaaa37e64183c708de64cb5cb7c3035a184