PowerExchange
PowerExchange is an OilRig (APT34, Hazel Sandstorm) backdoor associated with Iranian cyber-espionage activity. It was publicly documented in 2023 and was used in attacks targeting organizations in the Middle East, including activity against Israeli organizations. The malware uses an email-based command-and-control channel: it can receive commands and send back execution results through email, and it can exfiltrate files via that same channel. Reporting specifically notes that, unlike some related OilRig tooling, PowerExchange uses the victimized organization’s Microsoft Exchange Server to send messages to the attacker’s email account. PowerExchange has been discussed alongside the OilRig backdoor MrPerfectionManager, with both described as using email-based C2 protocols for exfiltration, and later tooling such as Veaty and Spearal was noted to share lineage with earlier OilRig implants including Karkoff and PowerExchange. The content also references PowerExchange in the context of Exchange-related threats and long-term email exfiltration implants. High-confidence behavioral details directly mentioned are limited to email-based C2, command execution result return via email, and file exfiltration through the email channel.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
the 2023 attacks targeting organizations in the Middle East with the PowerExchange and MrPerfectionManager backdoors
Techniques & procedures
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Stealth
1 technique
Stealth
The content repeatedly describes malware and threat actors decoding, decrypting, or deobfuscating payloads, strings, configuration data, commands, and C2 traffic prior to execution or use, e.g., 'APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload' and 'Action RAT can use Base64 to decode actor-controlled C2 server communications.'
Command and Control
4 techniques
Command and Control
Exfiltration
2 techniques
Exfiltration
ADVSTORESHELL exfiltrates data over the same channel used for C2... Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers... numerous malware and groups sent victim data, files, credentials, or host information over existing C2 channels.
Cannon exfiltrates collected data over email via SMTP/S and POP3/S C2 channels... CURIUM has used IMAP and SMTPS for exfiltration via tools such as IMAPLoader... Kevin can send data from the victim host through a DNS C2 channel... NightClub can use SMTP and DNS for file exfiltration and C2.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Earlier APT34 implant referenced as predecessor lineage for newer malware families.
Referenced as a specialized threat associated with attacks on Microsoft Exchange servers; no additional details are provided in the content.
A backdoor used in 2023 attacks attributed to OilRig against Middle Eastern organizations.
A backdoor associated with OilRig that uses the victim organization's Exchange Server for email-based command-and-control and data exfiltration.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.