APT / THREAT GROUP
POWERPLANT
2
aliases
Last seen:Mar 17, 2026
Intelligence Profile
This powershell code is a PowerShell written backdoor used by FIN7. Regarding to Mandiant that is was revealed to be a "vast backdoor framework with a breadth of capabilities, depending on which modules are delivered from the C2 server."
Threat Analysis
POWERPLANT is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.
External References
Quick Facts
TypeAPT / Threat Group
Aliases2
Also Known As
POWERPLANTps1.powerplant
External Intelligence
Malpedia: ps1.powerplantResearch Links
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.