Threat intelligence / Malware

POWERSOURCE

[POWERSOURCE](https://attack.mitre.org/software/S0145) is a PowerShell backdoor that is a heavily obfuscated and modified version of the publicly available tool DNS_TXT_Pwnage. It was observed in February 2017 in spearphishing campaigns against personnel involved with United States Securities and Exchange Commission (SEC) filings at various organizations. The malware was delivered when macros were enabled by the victim and a VBS script was dropped. (Citation: FireEye FIN7 March 2017) (Citation: Cisco DNSMessenger March 2017)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[POWERSOURCE](https://attack.mitre.org/software/S0145) is a PowerShell backdoor that is a heavily obfuscated and modified version of the publicly available tool DNS_TXT_Pwnage. It was observed in February 2017 in spearphishing campaigns against personnel involved with United States Securities and Exchange Commission (SEC) filings at various organizations. The malware was delivered when macros were enabled by the victim and a VBS script was dropped. (Citation: FireEye FIN7 March 2017) (Citation: Cisco DNSMessenger March 2017)

Labels

malware

7 recorded

Relationships

uses

from FIN7

Group

uses

to DNS

Technique

uses

to Ingress Tool Transfer

Technique

uses

to NTFS File Attributes

Technique

uses

Technique

uses

to Query Registry

Technique

uses

to Registry Run Keys / Startup Folder

Technique

5 external

References

mitre-attack

S0145

POWERSOURCE

—

DNSMessenger

—

Cisco DNSMessenger March 2017

http://blog.talosintelligence.com/2017/03/dnsmessenger.html

FireEye FIN7 March 2017

https://web.archive.org/web/20180808125108/https:/www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html