POWERSTATS

Internal ID: ps1.powerstats

aliases

Last seen:Mar 17, 2026

Intelligence Profile

POWERSTATS is a backdoor written in powershell.

It has the ability to disable Microsoft Office Protected View, fingerprint the victim and receive commands.

Threat Analysis

POWERSTATS is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→http://www.secureworks.com/research/threat-profiles/cobalt-ulster

→https://blog.malwarebytes.com/threat-analysis/2017/09/elaborate-scripting-fu-used-in-espionage-attack-against-saudi-arabia-government_entity/

→https://blog.prevailion.com/2020/01/summer-mirage.html

→https://blog.trendmicro.com/trendlabs-security-intelligence/campaign-possibly-connected-muddywater-surfaces-middle-east-central-asia/

→https://blog.trendmicro.com/trendlabs-security-intelligence/muddywater-resurfaces-uses-multi-stage-backdoor-powerstats-v3-and-new-post-exploitation-tools/

→https://marcoramilli.com/2020/01/15/iranian-threat-actors-preliminary-analysis/

→https://mp.weixin.qq.com/s/NN_iRvwA6yOHFS9Z3A0RBA

→https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/

→https://research.checkpoint.com/2019/the-muddy-waters-of-apt-attacks/

→https://sec0wn.blogspot.com/2017/10/continued-activity-targeting-middle-east.html

Quick Facts

TypeMalware Family

Aliases1

Also Known As

ps1.powerstats

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search POWERSTATS