malware

PowerExchange

S1173 · ATT&CK v19.2

Platforms

Windows

Tracked actors

Description

[PowerExchange](https://attack.mitre.org/software/S1173) is a PowerShell backdoor that has been used by [OilRig](https://attack.mitre.org/groups/G0049) since at least 2023 including against government targets in the Middle East.(Citation: Symantec Crambus OCT 2023)

Actors that use this

1 tracked actor

OilRig (APT34)ATT&CK-attributed