TF-MAL-ps1.powgoop

Description

ThreatFox malware family `ps1.powgoop`. Printable name: PowGoop.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• PDF Malware Analysis Report
  web:243246587.fs1.hubspotusercontent-na2.net

  Public Availability: This report is intended for public awareness and does not include confidential exploit code, live malware samples, or sensitive customer-specific information.

  2026-05-22 05:31 UTC
• PowGoop, Software S1046 | MITRE ATT&CK®
  web:attack.mitre.org

  PowGoop is a loader that consists of a DLL loader and a PowerShell-based downloader; it has been used by MuddyWater as their main loader. [1] [2]

  2026-05-22 05:31 UTC
• BPFDoor and Symbiote Rootkits Attacking Linux Systems Exploiting eBPF ...
  web:cybersecuritynews.com

  Two sophisticated Linux rootkits are posing increasingly serious threats to network security by exploiting eBPF technology to hide their presence from traditional detection systems. BPFDoor and Symbiote, both originating from 2021, represent a dangerous class of malware that combines advanced kernel-level access with powerful evasion capabilities. In 2025 alone, security researchers detected ...

  2026-05-22 05:31 UTC
• Boggy Serpens Threat Assessment
  web:unit42.paloaltonetworks.com

  Iranian threat group Boggy Serpens' cyberespionage evolves with AI-enhanced malware and refined social engineering. Unit 42 details their persistent targeting.

  2026-05-22 05:31 UTC
• PDF Malware Analysis Report - CISA
  web:www.cisa.gov

  Of the 23 malware samples analyzed, 14 files were identified as variants of the POWGOOP malware family . Two files were identified as JavaScript files that contain a PowerShell beacon.

  2026-05-22 05:31 UTC
• New eBPF Filters for Symbiote and BPFdoor Malware
  web:www.fortinet.com

  FortiGuard Labs discovered new Symbiote and BPFDoor variants exploiting eBPF filters to enhance stealth through IPv6 support, UDP traffic, and dynamic port hopping for covert C2 communication.

  2026-05-22 05:31 UTC
• Malware Analysis Report - Homeland Security Digital Library
  web:www.hsdl.org

  Of the 23 malware samples analyzed, 14 files were identified as variants of the POWGOOP malware family . Two files were identified as JavaScript files that contain a PowerShell beacon.

  2026-05-22 05:31 UTC
• PDF Iranian Government-Sponsored Actors Conduct Cyber Operations Against ...
  web:www.ic3.gov

  TLP: WHITE programs into running malware—and obfuscating PowerShell scripts to hide command and control (C2) functions. FBI, CISA, CNMF, and NCSC-UK have observed MuddyWater actors recently using various malware—variants of PowGoop , Small Sieve, Canop

  2026-05-22 05:31 UTC
• TTPs and Malware used by MuddyWater Cyber Espionage Group
  web:www.picussecurity.com

  Recently, MuddyWater has been observed to use various malware variants of PowGoop , Small Sieve, Canopy (also known as Starwhale), Mori, and POWERSTATS. Malware Used by MuddyWater 1. PowGoop DLL Loader PowGoop malware is a malicious DLL loader that disguises itself as a legitimate Google Update executable. PowGoop malware is made of 3 components.

  2026-05-22 05:31 UTC
• MuddyWater: Iranian APT Group TTPs, Malware & Defense Guide
  web:www.securityscientist.net

  A deep dive into MuddyWater — Iran's MOIS-linked APT. Learn their TTPs, malware arsenal (POWERSTATS, PowGoop , Small Sieve), targets, and how to defend against them.

  2026-05-22 05:31 UTC

Only Available for Registered Users. Sign in to view.