HOMETHREATSPOWERTRASH
APT / THREAT GROUP

POWERTRASH

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

This PowerShell written malware is an in-memory dropper used by FIN7 to execute the included/embedded payload. According to Mandiant's blog article: "POWERTRASH is a uniquely obfuscated iteration of a shellcode invoker included in the PowerSploit framework available on GitHub."

Threat Analysis

POWERTRASH is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://www.mandiant.com/resources/blog/evolution-of-fin7
→https://www.mandiant.com/resources/evolution-of-fin7
→https://www.recordedfuture.com/research/grayalpha-uses-diverse-infection-vectors-deploy-powernet-loader-netsupport-rat
→https://www.rewterz.com/rewterz-news/rewterz-threat-alert-widely-abused-msix-app-installer-disabled-by-microsoft-active-iocs

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

POWERTRASHps1.powertrash

External Intelligence

Malpedia: ps1.powertrash

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search POWERTRASH