Adlumin Threat Research has discovered a new malicious PowerShell Script known as PowerDrop that mainly targets the U.S. Aerospace Defense Industry. This custom-built malware uses deception, encoding, and encryption to evade EDR systems and detections. PowerDrop executes via WMI, uses non-standard forms of communication, has no disk presence, and uses other techniques consistent with those used by APT groups. Adlumin suspects nation-state actors may be at play given the state of the Russo-Ukrainian war, but it has not identified any specific APT yet. The malware consists of a novel Remote Access Tool (RAT) persistently embedded in Windows Management Instrumentation (WMI) and PowerShell. The code leverages Internet Control Message Protocol (ICMP) echo request messages as triggers for the malware’s command-and-control (C2) operations, including ICMP ping usage for data exfiltration. While it’s not uncommon to use PowerShell for remote access and employ WMI-based persistence of PowerShell scripts, along with ICMP triggering and tunneling, what makes this malware different is its distinctive structure and its capability to combine aspects of both basic threats and advanced tactics used by Advanced Persistent Threat (APTs) groups.

Impact: The most significant impact imposed on organizations by this threat is related to national security implications. Given the target being the U.S. Aerospace Defense Industry and the suspected involvement of nation-state actors, there are broader national security implications. The compromise of defense-related systems and information can jeopardize military capabilities, compromise strategic plans, and impact national security interests.

Recommendation: Organizations should deploy advanced security solutions that use behavior-based analysis to detect anomalous activities and suspicious behavior within the network. Organizations should also configure PowerShell execution policies to restrict the execution of unsigned and potentially malicious scripts, reducing the risk of the malware gaining access and persistence through PowerShell. Additionally, staying updated on the latest threat intelligence reports, collaborating with industry peers and government agencies, and sharing information to identify indicators of compromise associated with the malware and potential Advanced Persistent Threat (APT) groups will help organizations identify potential threats they are facing.

Several proof-of-concept attacks have demonstrated that the large language model (LLM) ChatGPT can be leveraged to create malware capable of evading EDR systems or polymorphic malware. It has been shown how a seemingly benign executable can make an API call to ChatGPT to create and then send dynamic versions of malicious code, thereby thwarting many kinds of cybersecurity tools. Ordinarily, LLMs like ChatGPT have content filters that prevent them from creating malicious content. Still, these filters can be bypassed by engineering prompts in a specific way, such as having ChatGPT interpret the prompt as a hypothetical question. This technique can be used to create polymorphic malware that mutates at runtime, making it challenging for threat scanners to identify. Several proof-of-concept examples, such as BlackMamba and ChattyCat, have showcased the potential of leveraging ChatGPT for polymorphic malware.

Impact: The impact of the potential exploitation of ChatGPT and other large language models for generating polymorphic malware is significant and raises several concerns, such as increased cybersecurity threats, evasion of detection systems, the need for advanced defense mechanisms, and regulatory challenges. The ability to bypass content filters and generate polymorphic code makes it more difficult for traditional endpoint detection and response systems to detect and mitigate malware. This opens up new avenues for cybercriminals and increases the sophistication of their attacks. Polymorphic malware created with the help of ChatGPT can mutate at runtime, making it challenging for security scanners and antivirus software to recognize and block such threats. This leads to an increased risk of successful attacks and compromises. The emergence of AI-powered malware necessitates the development of sophisticated AI-based defense systems capable of detecting and mitigating these evolving threats. Traditional security measures may become less effective against polymorphic malware generated by language models like ChatGPT. Regulating generative AI poses a significant challenge. As the technology industry is still exploring the full potential of these models, policymakers and regulators need help creating comprehensive regulations to address the risks associated with their misuse. Determining the appropriate regulatory approach, processes, and accountability becomes complex in this rapidly evolving landscape.

Recommendation: Organizations can take measures to mitigate the risks associated with the potential exploitation of language models like ChatGPT, such as implementing behavior-based anomaly detection. Instead of solely relying on signature-based detection methods, deploying behavior-based anomaly detection systems can identify unusual patterns of activity or code execution. This can help detect polymorphic malware generated by language models.