Check Point APT35 CharmPower January 2022

CharmPower can collect data and files from a compromised host.

CharmPower can change its C2 channel once every 360 loops by retrieving a new domain from the actors’ S3 bucket.

CharmPower has the ability to enumerate `Uninstall` registry values.

CharmPower has the ability to use ipconfig to enumerate system network settings.

Magic Hound has collected names and passwords of all Wi-Fi networks to which a device has previously connected.

CharmPower can use `netsh wlan show profiles` to list specific Wi-Fi profile details.

CharmPower can exfiltrate gathered data to a hardcoded C2 URL via HTTP POST.

CharmPower can use `wmic` to gather information from a system.

CharmPower can send victim data via FTP with credentials hardcoded in the script.

CharmPower has the ability to list running processes through the use of `tasklist`.

CharmPower can use PowerShell for payload execution and C2 communication.

The C# implementation of the CharmPower command execution module can use cmd.

CharmPower can delete created files from a compromised system.

CharmPower can use HTTP to communicate with C2.

CharmPower can enumerate the OS version and computer name on a targeted system.

CharmPower can enumerate drives and list the contents of the C: drive on a victim's computer.

CharmPower can download additional modules from actor-controlled Amazon S3 buckets.

CharmPower can retrieve C2 domain information from actor-controlled S3 buckets.

CharmPower has the ability to download additional modules to a compromised host.

CharmPower can remove persistence-related artifacts from the Registry.

CharmPower has the ability to capture screenshots.

CharmPower can send additional modules over C2 encoded with base64.

CharmPower can decrypt downloaded modules prior to execution.

Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).

CharmPower can list the installed applications on a compromised host.

CharmPower can send additional modules over C2 encrypted with a simple substitution cipher.

Magic Hound has acquired Amazon S3 buckets to use in C2.

Magic Hound has obtained and used tools like Havij, sqlmap, Metasploit, Mimikatz, and Plink.

Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to CVE-2021-44228 in Log4j and ProxyShell vulnerabilities; CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in on-premises MS Exchange Servers; and CVE-2018-13379 in Fortinet FortiOS SSL VPNs.