Hackers believed to be part of the Iranian APT35 state-backed group (aka ‘Charming Kitten’ or ‘Phosphorus’) has been observed leveraging Log4Shell attacks to drop a new PowerShell backdoor. The modular payload can handle C2 communications, perform system enumeration, and eventually receive, decrypt, and load additional modules.

Read full article on Bleeping Computer