GOFFEE's Cyber Assault: Unpacking the New PowerModul Espionage Toolkit Targeting Russia

In the shadowy world of cyber espionage, one name continues to resurface with growing concern: GOFFEE. This elusive threat actor has significantly escalated its offensive capabilities with the rollout of PowerModul — a highly flexible and stealthy PowerShell-based implant. This tool marks a dramatic shift in the group’s attack strategies, signaling a more refined, adaptive, and dangerous chapter in their campaign history.

Emerging in early 2022, GOFFEE’s evolution has been marked by calculated sophistication — moving from simple malicious web modules to complex infection chains capable of infiltrating high-value targets across Russia’s most critical sectors: government, energy, media, and telecommunications. As cyber warfare heats up globally, the revelations around PowerModul offer a chilling reminder of how threat actors continually push the boundaries of digital espionage.

Inside

GOFFEE, active since 2022, initially launched attacks using IIS modules like Owowa to infiltrate systems.
By mid-2023, the group pivoted to weaponizing legitimate Windows executables such as explorer.exe by injecting them with malicious shellcode during spear phishing campaigns.
Enter 2024: GOFFEE introduces PowerModul, a lightweight yet highly capable PowerShell implant that acts as the centerpiece of its operations.
This script establishes covert communication with command-and-control (C2) servers using unique system identifiers, such as usernames and disk serials.
PowerModul can download additional malware, execute remote commands, and exfiltrate sensitive data — all while evading detection through Base64 encoding and obfuscation.
Infection typically begins via RAR archives disguised as legitimate documents sent through spear phishing emails.
These archives often include patched executables or macro-laden Word files, launching layered payloads upon interaction.

– Supporting tools include:

– PowerTaskel: Assists in post-exploitation scripting.

FlashFileGrabber: Extracts and transmits files from USB drives.
USB Worm: Spreads the infection via removable media.
GOFFEE has begun favoring a Mythic-based binary agent for lateral movement, shifting away from PowerTaskel.
This binary agent, injected into memory during high-privilege operations, uses WinRM for network traversal — allowing attackers to stealthily navigate across compromised systems.
Secondary payloads are delivered through polyglot files (HTA scripts + shellcode), launched via mshta.exe to further obscure detection.
Between July and December 2024, attacks were tightly focused on Russian entities — particularly those involved in national infrastructure, confirming a preference for high-impact, strategic targets.
Analysts link the current operations to GOFFEE with high confidence, based on consistent use of tools, tactics, and victim profiles.
The development of PowerModul and its integration with the Mythic agent underscore a leap in sophistication and adaptability.
The threat landscape continues to shift, urging targeted organizations to harden defenses — particularly against phishing, PowerShell abuse, and memory-resident malware.

What Undercode Say:

GOFFEE’s campaign, as illustrated by the deployment of PowerModul, represents not just a technical escalation but a psychological one. The attackers are no longer merely exploiting vulnerabilities — they are mastering the art of disguise and persistence.

One of the most alarming aspects is the hybrid nature of their infections: combining legitimate Windows tools, Base64-encoded payloads, and polymorphic scripting. This multi-layered approach ensures that even if one layer is caught, the others may still go undetected. These aren’t just “smash-and-grab” cyber attacks — they are strategic infiltrations designed to linger, observe, and quietly siphon valuable data.

The use of PowerModul in conjunction with USB-spreadable tools and stealth agents like Mythic indicates a deliberate attempt to control both vertical (deep) and horizontal (wide) movement within a target environment. The blend of fileless malware, memory injection, and native Windows utilities makes detection and removal exceptionally difficult, especially for under-resourced or complacent organizations.

What truly sets GOFFEE apart is their patience. From reconnaissance to execution, the infection chain is meticulously staged. Spear phishing, although a familiar vector, becomes far more effective when bolstered with convincing social engineering and well-crafted payloads that exploit trust and routine.

Moreover, the transition to using binary Mythic agents for lateral movement shows the group’s evolution from scripting to compiled, memory-resident malware. These agents communicate over WinRM — a legitimate administrative protocol — making it even harder to distinguish between malicious and benign activity.

Another critical point: the targeting of Russian infrastructure. This choice isn’t random. It’s strategic — possibly politically motivated, ideologically driven, or tied to cybercrime-for-profit operations. Governmental, energy, and media organizations are gold mines for data that can be weaponized or monetized.

The layered infection strategy, which includes HTA polyglots and mshta.exe-based execution, demonstrates how GOFFEE is engineering attacks that bypass conventional antivirus and endpoint detection systems. It’s a cat-and-mouse game where the mouse has now grown smarter — and faster.

For defenders, this means rethinking threat models. Traditional perimeter defenses aren’t enough. Behavioral analysis, endpoint visibility, and rapid response mechanisms must be at the core of any serious security posture.

From an

Bottom line: GOFFEE is no longer just a persistent threat — it’s an evolving one. Their latest campaign is a textbook case in modern cyber warfare, emphasizing stealth, adaptability, and high-value targeting. The days of simple malware are gone. What we’re witnessing now are bespoke espionage operations crafted with military-like precision.

Fact Checker Results:

PowerModul’s functions and deployment align with documented tactics used by advanced persistent threats (APTs).
GOFFEE’s attribution is supported by consistent use of tools, targets, and infection techniques across campaigns.
Mythic agent usage is verified through recent forensic analysis of memory dumps and command logs in affected organizations.