APT33 Elevates C2 Capabilities with New PowerShell Malware
- Actor Motivations: Espionage,Exfiltration
- Attack Vectors: Malware,Spear Phishing
- Attack Complexity: Medium
- Threat Risk: High Impact/Low Probability
Threat Overview
Norfolk InfoSec analyzed a custom PowerShell backdoor linked to APT33's mid-2019 campaign, identified through infrastructure pivots on the confirmed C2 domain backupaccount[.]net — a domain publicly flagged by US Cyber Command, ClearSky, and FireEye. The malware defines 14 functions and implements a full-featured C2 framework: it communicates with its control server via JSON-masked HTTP requests, supports active and silent operating modes with dynamically adjusted polling intervals (5–10 seconds active, 45–70 minutes silent), and implements two separate persistence mechanisms — WMI event filters and HKCU registry Run keys (smrsservice.exe). Core capabilities include file upload and download (with recursive directory traversal), screenshot capture, privilege checking, credential-related commands (SAM hive, LDAP, and an external invoke-pass module), arbitrary PowerShell command execution via invoke-expression, and encrypted C2 communications. The malware's modular command structure — with operator-controlled mode switching and clean-up via a paired "left" command — reflects a mature, operationally disciplined C2 design consistent with APT33's known capability level.
Detected Targets
| Type | Description | Confidence |
|---|---|---|
| Sector | Aerospace None | Medium |
| Sector | Energy None | Medium |
| Region | United States None | High |
| Region | Middle East Countries None | Medium |
Extracted IOCs
- backupaccount[.]net
- 985797eb1a75f297359bf52aa7c27715
- 2c2cc6c42c6ccf74d96e5913277537679ec20fba
- 6bea9a7c9ded41afbebb72a11a1868345026d8e46d08b89577f30b50f4929e85
Tip: 4 related IOCs (0 IP, 1 domain, 0 URL, 0 email, 3 file hash) to this threat have been found.
Overlaps
Source: Hyas - September 2019
Detection (one case): backupaccount[.]net
Hint: Overlaps are extracted automatically by examining the IOCs associated with all indexed threats and actors.
FAQs
Frequently Asked Questions
Researchers discovered a custom PowerShell backdoor used by APT33 — an Iranian state-aligned hacking group — during an active campaign in mid-2019. The malware was found through infrastructure pivots on a C2 domain publicly confirmed by US Cyber Command. It gives attackers persistent, encrypted remote access to compromised systems with a broad range of capabilities including file theft, credential harvesting, screenshot capture, and arbitrary command execution.
APT33 is an Iranian state-aligned threat group active since at least 2013. This malware was linked to APT33 through shared C2 infrastructure — specifically backupaccount[.]net — which was simultaneously flagged by US Cyber Command, ClearSky, FireEye, and multiple independent researchers as part of the same APT33 June 2019 campaign. The domain was also identified in a separate HYAS report tracking APT33 domain registrations.
The malware is designed for sustained espionage and data theft. Once deployed, it gives APT33 operators persistent remote access to victim systems, the ability to steal files and credentials, take screenshots, and run any command on the compromised machine. The credential-targeting commands — SAM hive dumps, LDAP queries, and an external password-dumping module — suggest the group also intended to harvest credentials for lateral movement into broader network environments.
The malware was active in the United States and likely the Middle East, consistent with APT33's known targeting patterns in this period. Specific victim organizations were not identified in this source — the analysis focused on the malware itself rather than confirmed victims. The campaign coincided with broader APT33 activity that was publicly flagged by US Cyber Command in July 2019.
The malware was delivered via malicious HTA (HTML Application) files hosted on APT33-controlled infrastructure. Once executed on a victim machine, the PowerShell backdoor connects to its C2 server and enters a command loop, polling for instructions from the operator. It can switch between active mode (polling every 5–10 seconds) and silent mode (polling every 45–70 minutes), making detection harder during periods when the attacker wants to reduce network noise.
The malware uses two separate persistence methods. First, it can create a WMI event filter — a Windows system mechanism — that causes the malware to run automatically even after reboots. Second, it can modify the Windows registry to add an entry that launches a file called smrsservice.exe every time a user logs in. Both methods can be removed simultaneously using a single operator command ("left"), showing deliberate operational security planning.
This malware reflects a notable advancement in APT33's tooling compared to simpler scripts or commodity malware. The modular 14-function design, encrypted C2 communications, dual persistence mechanisms, active/silent mode switching, and clean built-in clean-up capabilities suggest a professionally developed tool built for long-term, disciplined operations. The credential-harvesting command set indicates the group was preparing for deeper network penetration beyond the initially compromised machine.
Block the known C2 domain (backupaccount[.]net) and file hashes at network and endpoint layers. Monitor for WMI event filter creation by non-administrative processes and alert on new HKCU registry Run key entries pointing to executables in %APPDATA%. Block or alert on PowerShell processes making outbound HTTP/S connections, and flag uses of invoke-expression with encoded or externally sourced arguments. Consider enabling PowerShell script block logging to capture malicious scripts at execution time.