Open Source PowerShell-Written Post Exploitation Frameworks Used by Cyber Espionage Groups

Cyber espionage groups are sophisticated adversary groups that conduct complex attack campaigns against their targets. As cyber espionage activities increase, there will be an increased pressure on these groups to quickly and effectively conduct their cyber operations against their targets. Using open source hacking tools can allow these groups to meet this demand by lowering resources which would otherwise be used to develop customized tooling. Using a language such as PowerShell which is widely available on target systems, cyber espionage groups can use tools that require less setup and manipulation to operate. Open source PowerShell-written post exploitation frameworks allow cyber espionage groups to leverage open source tooling on the PowerShell platform. This makes an ideal attack platform to conduct cyber operations from. This paper details cyber espionage groups that use open source PowerShell-written post exploitation frameworks and describe how they are used. The goal of this research is to understand how this tooling is used and identify trends that can lead to insights on future usage.