PowerPepper also adds steganography to the list of evasion techniques, which is the practice of hiding data inside images. In this case, the malicious code is embedded in what appears to be regular pictures of ferns or peppers (hence the name), and it is then extracted by a loader script. The loader is disguised as a verification tool from identity services provider GlobalSign.
It uses custom obfuscation, with parts of its malicious delivery scripts hidden in Word-embedded objects. Communications with the implant and servers are encrypted and the usage of trusted, signed scripts makes it difficult for the antivirus software to recognize the implant as malicious at startup. The first variant of PowerPepper emerged in the wild in mid-July 2020, as dropped from a Word Document that had been submitted on a public multiscanner service. PowerPepper was cultivated to execute remote shell commands sent by DeathStalker operators, which are aimed at stealing sensitive business information.