POWERSTATS

aliases

Last seen:Mar 17, 2026

Intelligence Profile

POWERSTATS is a backdoor written in powershell.

It has the ability to disable Microsoft Office Protected View, fingerprint the victim and receive commands.

Threat Analysis

POWERSTATS is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→http://www.secureworks.com/research/threat-profiles/cobalt-ulster

→https://blog.malwarebytes.com/threat-analysis/2017/09/elaborate-scripting-fu-used-in-espionage-attack-against-saudi-arabia-government_entity/

→https://blog.prevailion.com/2020/01/summer-mirage.html

→https://blog.trendmicro.com/trendlabs-security-intelligence/campaign-possibly-connected-muddywater-surfaces-middle-east-central-asia/

→https://blog.trendmicro.com/trendlabs-security-intelligence/muddywater-resurfaces-uses-multi-stage-backdoor-powerstats-v3-and-new-post-exploitation-tools/

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

POWERSTATSps1.powerstatsValyria

External Intelligence

Malpedia: ps1.powerstats

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search POWERSTATS