TF-MAL-ps1.powernet
📛 Threat Title
Malware family: PowerNet
Description
ThreatFox malware family `ps1.powernet`. Printable name: PowerNet.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
ps1.powernet
VT: VT base fetch failed: HTTPError: 429 Too Many Requests for domains/ps1.powernet
IOC database
- Type
- domain
- Value
ps1.powernet- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-ps1.powernet
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Too Many Requests for domains/ps1.powernet
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:advisory.eventussecurity.com
Third, a TDS previously unseen in GrayAlpha activity—referred to as TAG-124—is used to drive traffic toward malware delivery endpoints. The PowerNet loader is a custom PowerShell script that unpacks and runs NetSupport RAT, while a second loader, MaskBat, shows connections to the FakeBat family , adding layers of obfuscation and persistence.
-
web:blog.netmanageit.com
SUMMARY : Insikt Group uncovered new infrastructure linked to GrayAlpha, a threat actor associated with FIN7. They identified a custom PowerShell loader named PowerNet that deploys NetSupport RAT, and another loader called MaskBat. Three main infection vectors were discovered: fake browser updates, fake 7-Zip download sites, and the TAG-124 traffic distribution system. While all three methods ...
-
web:cyberpress.org
Security researchers from Insikt Group have identified new infrastructure and attack methodologies attributed to GrayAlpha, a threat actor with strong overlaps with the notorious FIN7 group. The latest campaigns reveal that GrayAlpha is actively deploying fake browser update sites and other deceptive download vectors to deliver custom malware loaders including a newly discovered PowerNet ...
-
web:cybersecuritynews.com
Two sophisticated Linux rootkits are posing increasingly serious threats to network security by exploiting eBPF technology to hide their presence from traditional detection systems. BPFDoor and Symbiote, both originating from 2021, represent a dangerous class of malware that combines advanced kernel-level access with powerful evasion capabilities. In 2025 alone, security researchers detected ...
-
web:gbhackers.com
Custom Malware Uncovered The latest findings reveal GrayAlpha's use of custom malware , including a PowerShell loader dubbed PowerNet , designed to decompress and execute NetSupport RAT, a remote access trojan widely abused for malicious purposes.
-
web:learn.microsoft.com
Remediate security weaknesses discovered through security recommendations, and create exceptions if needed, in Defender Vulnerability Management.
-
web:malpedia.caad.fkie.fraunhofer.de
According to Insikt Group, PowerNet is a custom Powershell loader that decompresses and executes NetSupport RAT.
-
web:www.broadcom.com
GrayAlpha, a cybercriminal group associated with FIN7, has been reported conducting a sophisticated malware campaign using multiple infection vectors to distribute NetSupport RAT via custom PowerShell loaders, PowerNet and MaskBat.
-
web:www.fortinet.com
FortiGuard Labs discovered new Symbiote and BPFDoor variants exploiting eBPF filters to enhance stealth through IPv6 support, UDP traffic, and dynamic port hopping for covert C2 communication.
-
web:www.recordedfuture.com
Insikt Group exposes GrayAlpha's evolving infrastructure and infection methods—including PowerNet and MaskBat loaders, fake 7-Zip sites, and the undocumented TAG-124 network—linking the group to FIN7's advanced cybercriminal operations.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.