PowerModul

PowerModul is a PowerShell implant/loader used by the GOFFEE APT group in campaigns against organizations in Russia. The first observed uses were in early 2024, and it was documented in attacks during July-December 2024 targeting media, telecommunications, construction, government, and energy organizations. GOFFEE reportedly used targeted phishing emails with malicious RAR archives as the primary initial access vector. Observed delivery chains included RAR archives containing macro-enabled Microsoft Office documents; when macros were enabled, the document created an HTA file and a PowerShell file, set HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\LOAD for persistence, and launched JavaScript that executed the PowerModul PowerShell implant stored as UserCache.ini. One reported PowerModul sample, UserCache.ini, had MD5 60A53D2C653991F086C4E6663D652CF2 and SHA256 BE1D0FAF1C253FAACBA1059971B01D1D646256D7B2E557DA55ED059542AFDBCD.

PowerModul retrieves additional PowerShell payloads from a command-and-control server and executes them. It appends a victim identifier containing the computer name, username, and disk serial number to the C2 URL, and receives XML responses containing Base64-encoded scripts. Researchers identified a distinct protocol, payload types, and C2 infrastructure compared with PowerTaskel, and therefore classified PowerModul as a separate malware family. The implant includes an OfflineWorker() function that decodes and executes embedded Base64 content; this functionality was observed carrying code for the FlashFileGrabber data theft tool.

Observed payloads delivered by PowerModul included PowerTaskel, FlashFileGrabber, and USB Worm. FlashFileGrabber searched removable media for files with targeted extensions and copied them to %TEMP%\CacheStore\connect<VolumeSerialNumber>, storing metadata in ftree.db and MD5 hashes of that metadata in %AppData%\internal_profiles.db. USB Worm infected removable media by hiding original files, copying PowerModul as UserCache.ini, and creating hidden VBS and BAT launchers plus deceptive shortcuts. PowerModul is associated with GOFFEE's broader post-exploitation activity, which also included use of Mythic agents, PsExec, mshta.exe, and WinRM for privilege escalation and lateral movement.