PowerPunch - S0685 (d52291b4-bb23-45a8-aef0-3dc7e986ba15)

PowerPunch is a lightweight downloader that has been used by Gamaredon Group since at least 2021.(Citation: Microsoft Actinium February 2022)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736)	Attack Pattern	PowerPunch - S0685 (d52291b4-bb23-45a8-aef0-3dc7e986ba15)	Malware	1
Ingress Tool Transfer - T1105 (e6919abc-99f9-4c6c-95a5-14761e7b2add)	Attack Pattern	PowerPunch - S0685 (d52291b4-bb23-45a8-aef0-3dc7e986ba15)	Malware	1
Command Obfuscation - T1027.010 (d511a6f6-4a33-41d5-bc95-c343875d1377)	Attack Pattern	PowerPunch - S0685 (d52291b4-bb23-45a8-aef0-3dc7e986ba15)	Malware	1
PowerPunch - S0685 (d52291b4-bb23-45a8-aef0-3dc7e986ba15)	Malware	Environmental Keying - T1480.001 (f244b8dd-af6c-4391-a497-fc03627ce995)	Attack Pattern	1
PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736)	Attack Pattern	Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830)	Attack Pattern	2
Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a)	Attack Pattern	Command Obfuscation - T1027.010 (d511a6f6-4a33-41d5-bc95-c343875d1377)	Attack Pattern	2
Execution Guardrails - T1480 (853c4192-4311-43e1-bfbb-b11b14911852)	Attack Pattern	Environmental Keying - T1480.001 (f244b8dd-af6c-4391-a497-fc03627ce995)	Attack Pattern	2