Educated Manticore – Iran Aligned Threat Actor Targeting Israel via Improved Arsenal of Tools By etal Published: 2023-04-25 · Archived: 2026-04-07 14:36:06 UTC Key Findings: In this report we reveal new findings related to Educated Manticore, an activity cluster with strong overlap with Phosphorus, an Iranian-aligned threat actor operating in the Middle East and North America. Like many other actors, Educated Manticore has adopted recent trends and started using ISO images and possibly other archive files to initiate infection chains. In the report we reveal Iraq-themed lures, most likely used to target entities in Israel The actor has significantly improved its toolset, utilizing rarely seen techniques, most prominently using .NET executables constructed as Mixed Mode Assembly – a mixture of .NET and native C++ code. It improves tools’ functionality and makes the analysis of the tools to be more difficult. The final executed payload is an updated version of the Implant PowerLess, previously tied to some of Phosphorus ransomware operations. Introduction In this report, Check Point research reveals new findings of an activity cluster closely related to Phosphorus. The research presents a new and improved infection chain leading to the deployment of a new version of PowerLess. This implant was attributed to Phosphorus in the past, an Iran-affiliated threat group operating in the Middle East and North America. Phosphorus has been linked to a wide variety of activities, ranging from ransomware to spear-phishing of high-profile individuals. While the new PowerLess payload remains similar, its loading mechanisms have significantly improved, adopting techniques rarely seen in the wild, such as using .NET binary files created in mixed mode with assembly code. The newly discovered version is likely intended for phishing attacks focused around Iraq, using an ISO file to initiate the infection chain. Other documents inside the ISO file were in Hebrew and Arabic languages, suggesting the lures were aimed at Israeli targets. As the details of this attack were uncovered, two other, very similar lures have drawn our research team’s attention. Based on internal naming conventions and previous submissions, we assume with medium confidence that those lures were part of testing efforts of the same threat actor. Check Point Research tracks this activity cluster as Educated Manticore. PowerLess Infection Chain Analysis High-level Overview Educated Manticore deployment of PowerLess is a multi-staged process that contains several custom components: Lure ( Iraq development resources.iso  as well as the documents within it) Initial Loader ( Iraq development resources.exe , later changed to  syscall01.exe ) Downloader (stored encrypted within  zoom.jpg ) PowerLess Loader ( syscall02.exe , downloaded by  zoom.jpg ) PowerLess Payload (stored encrypted within  asdfg , downloaded by  zoom.jpg ). The complete chain is depicted below: Figure 1 – High-level overview of Educated Manticore’s PowerLess infection chain https://research.checkpoint.com/2023/educated-manticore-iran-aligned-threat-actor-targeting-israel-via-improved-arsenal-of-tools/ Page 1 of 14 ISO and Lures The file  Iraq development resources.iso  was submitted to VirusTotal by two submitters from Israeli IP addresses. At the time of this writing, it has 0 detections, possibly affected by its large size (18.5 MB). It is worth noting that the initial loader embedded in the ISO file also has a low detection rate. Figure 2 - ISO image detections on VirusTotal Figure 2 – ISO image detections on VirusTotal The ISO file is designed to deceive the user. Its structure is unique, containing a relatively large number of files in three hidden folders with names containing non-breaking spaces, in addition to the initial loader, disguised as a folder as well. A summary of the files in the ISO image: Figure 3 - Contents of ISO image Figure 3 – Contents of ISO image Of the three folders, the first contains an encrypted version of a custom downloader stored as  zoom.jpg . The second and third are identical in terms of subfolder and file names, while one contains actual PDF lures and the other contains the same files XORed with  ‘0x0a’  in the decimal format. The lures were divided into subfolders by language, containing files in Arabic, English, and Hebrew. All of them are PDF files with academic content about Iraq, suggesting the targets might have been academic researchers. Figure 4 - PDF lures Figure 4 – PDF lures What might appear in the picture as a fourth folder is actually the initial loader, a PE file named  Iraq development resources.exe  that is disguised as an empty folder, prompting users to click it without noticing its extension. Initial Loader Iraq development resources.exe  is the first malicious component that initiates the infection chain upon execution. It is a 64-bit PE designed to decrypt and execute a custom downloader from the file  zoom.jpg  that is embedded in the ISO file as well, using the open-source project RunPE-In-Memory. The Initial loader itself is obfuscated, most likely with compiler-generated pattern-based obfuscation. In this case, the obfuscation resulted in about 1282 blocks full of junk code. Appendix “A” provides a dedicated IDAPython script we created to de-obfuscate the code. Figure 5 - Comparison between code flow before and after de-obfuscation Figure 5 – Comparison between code flow before and after de-obfuscation To make the analysis even more difficult, the actors have implemented an additional layer of 13 customized string-decryption functions that are based on TEA32 (Tiny-Encryption-Algorithm), where each function uses a different decryption key and is implemented to work on a certain length of the string. Appendix “B” provides a dedicated IDAPython script we created to decrypt the code. Upon execution, the initial loader: 1. Creates the directory  C:\Users\User\AppData\Local\SystemCall . 2. Copies itself with the name  syscall01.exe  to the above folder. The malware also attempts to copy  zoom.jpg  to the same folder, but fails because of improper handling of spaces. 3. Constructs the path to the file  zoom.jpg , stored in a non-breaking space folder ( \\\xA0 ) in the ISO image, as depicted below: Figure 6 - Invoking zoom.jpg in memory using RunPE-In-Memory Figure 6 – Invoking zoom.jpg in memory using RunPE-In-Memory 4. Decrypts the contents of the downloader to memory from  zoom.jpg  using AES-256-CBC with the KEY qweasdzxcrtyfghvqweasdzxcrtyfghv and IV  ddssajliodqsdedw . The decryption is implemented in a custom https://research.checkpoint.com/2023/educated-manticore-iran-aligned-threat-actor-targeting-israel-via-improved-arsenal-of-tools/ Page 2 of 14 version of RunPE-In-Memory, built to handle the encrypted payload, map it to memory, and execute it at its entry point, as seen below, compared to the original project code. Figure 7 - Comparison between publicly available RunPE-In-Memory and Educated Manticore version Figure 7 – Comparison between publicly available RunPE-In-Memory and Educated Manticore version Downloader The decrypted file extracted from  zoom.jpg  is 64-bit PE with the main purpose of downloading and executing the next stages. The downloader is obfuscated similar to the initial loader, affected with the same compiler-generated pattern-based obfuscation, and can also be de-obfuscated with the same script provided in Appendix “A”. The string decryption is also implemented similarly, but this time using 16 different customized string-decryption functions based on TEA32 (Tiny-Encryption-Algorithm). After it is loaded into memory and run, the downloader: 1. Starts Explorer in one of the “iso” subfolders, imitating a real folder opening. 2. Creates a persistence for  syscall01.exe  (the newly created copy of the initial loader) by setting the registry value HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell . The persistence is configured only if the malware does not run from the  AppData  directory and if  syscall01.exe  does not exist in the folder  C:\Users\User\AppData\Local\SystemCall . In the flow described above, this persistence is not configured, because the  syscall01.exe  is created in a previous stage exactly in the folder  C:\Users\User\AppData\Local\SystemCall , indicating of possible different execution flow use-case of this downloader. 3. Downloads the PowerLess loader through a POST request to an attacker-controlled domain https://subinfralab[.]info/qaMspFbEmg , saving the file as C:\Users\User\AppData\Local\SystemCall\syscall02.exe . 4. Downloads the encrypted PowerShell payload content through a POST request to the same server https://subinfralab[.]info/hgAdDiLmnB , saving as  C:\Users\Public\asdfg . Figure 8 - Payload downloaded from attacker-controlled domain Figure 8 – Payload downloaded from attacker-controlled domain 5. Executes the PowerLess loader through the command  explorer C:\Users\User\AppData\Local\SystemCall\syscall02.exe . PowerLess Loader The downloaded executable file  syscall02.exe , dubbed as the “PowerLess Loader”, is a 64-bit .NET PE constructed as Mixed Mode Assembly. It is designed to load the encrypted PowerShell script backdoor  asdfg , dubbed as “PowerLess Payload”, decrypt it, and invoke it in memory. In addition, it also performs a few evasion techniques, such as AMSI Bypass and ETW Bypass. Right upon the first inspection of the PE structure, a few characteristics point to this .NET sample being constructed as Mixed-Mode Assembly. The “IL Only” flag inside the .NET directory flags is not checked. This means that the sample could contain not only IL code, but also unmanaged code. In addition, the Import Directory contains a set of entries for native libraries. Figure 9 - Inspection of unique .NET elements - “IL Only” flag not check and imported native libraries Figure 9 – Inspection of unique .NET elements – “IL Only” flag not check and imported native libraries Reverse-engineering a mixed-mode assembly code is different from pure .NET assembly code, requiring both native and IL code disassemblers. The native CRT entry point  mainCRTStartup() redirects the execution back to the managed code – directly to the method  main() , where all logic resides. The construction of certain strings is the first logic observed in this method. Recreating these strings reveals functionality related to the evasion techniques AMSI Bypass and ETW Bypass, as well as keys and paths required to invoke the PowerLess payload later. Figure 10 - Reconstruction of AMSI and ETW bypasses related strings Figure 10 – Reconstruction of AMSI and ETW bypasses related strings https://research.checkpoint.com/2023/educated-manticore-iran-aligned-threat-actor-targeting-israel-via-improved-arsenal-of-tools/ Page 3 of 14 Following the execution of the bypasses mentioned above, the loader reads the contents of the file stored in  C:\Users\Public\asdfg , previously downloaded by the downloader. For the decryption, AES-128-ECB with the previously constructed key  {}nj45kdada0slfk  is used. Once the PowerLess Payload  asdfg  is decrypted, it is executed in-memory in the context of  syscall02.exe , using an instance of class  System.Management.Automation.PowerShell  and the applicable methods. Figure 11 - Invocation of PowerShell payload extracted from the file C:\Users\Public\asdfg Figure 11 – Invocation of PowerShell payload extracted from the file C:\Users\Public\asdfg PowerLess Payload The final payload is a new version of the previously reported PowerLess PowerShell payload. This version, however, is more mature, supporting a much wider set of commands. It contains an internal configuration, including its Command and Control server (C&C), using the previously mentioned attacker-owned domain  subinfralab[.]info . Figure 12 - PowerLess configuration Figure 12 – PowerLess configuration A short inspection of the supported commands in the newer version in comparison to the ones in the previously reported sample provides insight into the significant development the payload has gone through. Among the new features – showing the list of installed programs, showing the list of processes, showing a list of files, stealing user data from the Telegram desktop app, and taking screenshots. Previous Version Current Version Browser Command Download Kill Operation Browser Command Download Index Multi Operation Proc Prog Shot Sound Tele update Upload Among its capabilities, PowerLess can download extra modules, including a keylogger, browser information stealer, and a surroundings sound recorder. Previous reports have linked a similar sound recording tool to PowerLess actors, but since then, they embed it within the malware and activate it upon the “sound” command from the C&C server. The tool is downloaded from the server and saved as  C:\Windows\temp\ugt\so.zip . Figure 13 - Newly embedded “sound” command as seen in PowerLess payload Figure 13 – Newly embedded “sound” command as seen in PowerLess payload PowerLess C&C communication to the server is Base64-encoded and encrypted after obtaining a key from the server. To mislead researchers, the threat actor actively adds three random letters at the beginning of the encoded blob. The backdoor starts by initiating a request to receive the communication encryption key from the C&C server: Plain text Copy to clipboard Open code in new window EnlighterJS 3 Syntax Highlighter {"BotId":"1D1FB0BB21B94FC0B017A4DADA231E17","GroupName":"SLM","type":"fetchkey"} https://research.checkpoint.com/2023/educated-manticore-iran-aligned-threat-actor-targeting-israel-via-improved-arsenal-of-tools/ Page 4 of 14 {"BotId":"1D1FB0BB21B94FC0B017A4DADA231E17","GroupName":"SLM","type":"fetchkey"} {"BotId":"1D1FB0BB21B94FC0B017A4DADA231E17","GroupName":"SLM","type":"fetchkey"} In response, the C&C server sends a key and a “first-time” flag: Plain text Copy to clipboard Open code in new window EnlighterJS 3 Syntax Highlighter { "Key" : "X9w4tpLJErwNCKYA", "first" : "1" } { "Key" : "X9w4tpLJErwNCKYA", "first" : "1" } { "Key" : "X9w4tpLJErwNCKYA", "first" : "1" } In the first run, the PowerShell backdoor enumerates the system and sends recon data nested in “info”, including the computer name, username, operating system, IP address, installation path, computer manufacturer, and security software installed: Plain text Copy to clipboard Open code in new window EnlighterJS 3 Syntax Highlighter {"BotId":"1D1FB0BB21B94FC0B017A4DADA231E17", "type":"sendinfos", "info":} {"BotId":"1D1FB0BB21B94FC0B017A4DADA231E17", "type":"sendinfos", "info":} {"BotId":"1D1FB0BB21B94FC0B017A4DADA231E17", "type":"sendinfos", "info":