H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

POWERTON

[POWERTON](https://attack.mitre.org/software/S0371) is a custom PowerShell backdoor first observed in 2018. It has typically been deployed as a late-stage backdoor by [APT33](https://attack.mitre.org/groups/G0064). At least two variants of the backdoor have been identified, with the later version containing improved functionality.(Citation: FireEye APT33 Guardrail)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[POWERTON](https://attack.mitre.org/software/S0371) is a custom PowerShell backdoor first observed in 2018. It has typically been deployed as a late-stage backdoor by [APT33](https://attack.mitre.org/groups/G0064). At least two variants of the backdoor have been identified, with the later version containing improved functionality.(Citation: FireEye APT33 Guardrail)

Labels

malware
7 recorded

Relationships

uses
from APT33
Group
uses
to PowerShell
Technique
uses
to Registry Run Keys / Startup Folder
Technique
uses
to Security Account Manager
Technique
uses
to Symmetric Cryptography
Technique
uses
to Web Protocols
Technique
uses
to Windows Management Instrumentation Event Subscription
Technique
2 external

References

mitre-attack
S0371
open
FireEye APT33 Guardrail
https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance