Loading malware…
TAMECAT is a modular PowerShell-based backdoor used in espionage operations and attributed in the provided reporting to the Iranian state-sponsored actor APT42, including activity tracked as SpearSpecter and overlaps with GreenCharlie/POWERSTAR-related tooling. It is described as operating largely in memory to minimize forensic artifacts and evade conventional endpoint detection.
Observed delivery and infection chains include prolonged social engineering, often via WhatsApp impersonation and meeting or conference lures, as well as malicious links abusing the Windows search-ms protocol to trigger WebDAV access to attacker-controlled shares exposing malicious LNK files disguised as PDFs. Other reporting in the content describes a VBScript downloader that queries installed antivirus products via WMI and conditionally launches PowerShell via conhost.exe or uses cmd.exe/curl to retrieve subsequent stages. Loaders and staging infrastructure mentioned include Temp.bat, nconf.txt and df32s.txt hosted via services such as tebi.io and Cloudflare Workers.
TAMECAT uses a multi-stage, obfuscated PowerShell framework with layered decoding and AES decryption. Reported obfuscation includes fragmented Base64 payloads, runtime string reconstruction, wildcard command resolution, string replacement, and in-memory execution. The malware has been associated with variants or related framework names including GORBLE and POWERSTAR.
Capabilities directly described in the content include host reconnaissance, remote command execution, browser data theft, screenshot capture, file harvesting, Outlook OST collection, and staged exfiltration. Reconnaissance data includes OS version, hostname, domain, privilege level, network configuration, uptime, patch status, installed software, persistence locations, process information, and antivirus/endpoint product enumeration. File collection targets documents, archives, media, images, and password database files such as .kdbx while excluding noisy paths such as OneDrive, AppData, cache, Windows, and development folders.
For browser theft, TAMECAT abuses Microsoft Edge remote debugging on localhost:9222 to extract decrypted cookies via the DevTools Protocol and stores stolen Edge cookie data in JSON files under %LOCALAPPDATA%\Caches\BS\Cookie__Last<id>.json. To access Chrome profile databases, it has used Sysinternals PsSuspend to suspend Chrome and release SQLite locks, then used Edge as an intermediary to open Chrome Login Data, Cookies, and Web Data files and parse them with System.Data.SQLite.dll. Reporting also states it steals login credentials from Microsoft Edge and Google Chrome and can collect cookies and history from Chrome, Edge, and Firefox.
Screen capture functionality reportedly takes repeated screenshots, and file staging/exfiltration modules compress data using a renamed WinRAR binary (R.exe). A .NET helper named Runs.dll is described as splitting large files into 5 MB Base64-encoded chunks for streaming exfiltration. Exfiltration can occur over HTTPS and FTP.
Command-and-control channels described in the content include HTTPS, Telegram, Discord, Cloudflare Workers, Firebase Realtime Database, and WebDAV. The reporting states this was the first recorded instance of APT42 using Telegram and Discord as C2 channels. The Telegram module polls a bot for commands, can execute arbitrary PowerShell received through messages, writes output to $env:TEMP\UZ4sWF2aV.txt, and returns results to the bot. The Discord module uses a webhook for host info, retrieves commands from a channel, searches for messages from a specific user named mick, and stores the last processed message ID in HKCU:\SOFTWARE\firstOrder\id.
Network protection and encoding details in the content include Base64-encoded C2 traffic and AES-256-encrypted transfers using the hardcoded key kNz0CXiP0wEQnhZXYbvraigXvRVYHk1B with a random 16-character IV. The IV is transmitted in a custom HTTP header named Content-DPR in some reporting; another report in the content states the IV was sent via a custom field named Sec-Host. One analyzed sample used SessionUrl hxxps://accurate-sprout-porpoise[.]glitch[.]me and a hardcoded token GILNH9LX6TCZ9V8ZZSUF. Additional infrastructure mentioned includes darijo-bosanac-dl[.]workers[.]dev, cloudcaravan[.]info, filenest[.]info, datadrift[.]somee[.]com, filenest[.]osc-fr1.scalingo.io, and s3[.]tebi[.]io.
Persistence mechanisms described include storing scripts under %LOCALAPPDATA%\Microsoft\Windows\AutoUpdate for in-memory execution, creating a per-user Run key named Renovation under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, launching files from %LOCALAPPDATA%\Microsoft\Internet Explorer\List\ at logon, setting HKCU:\Console%Startup%\DelegationConsole and DelegationTerminal values, and using the per-user UserInitMprLogonScript value to run Microsoft.bat. Victim identifiers were reported in different samples at HKCU:\SOFTWARE\MSCore\config or %LOCALAPPDATA%\config.txt.
Targets explicitly mentioned in the content include senior defense and government officials, government and defense organizations, NGOs, media, educational institutions, activists, legal services, and in some reporting family members of primary targets. The overall use case described is long-term Iranian intelligence collection and credential theft against high-value victims.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
For long-term data-driven access, they deploy a sophisticated PowerShell-based backdoor known as TAMECAT... with modular components designed to facilitate data exfiltration and remote control.
For long-term data-driven access, they deploy a sophisticated PowerShell-based backdoor known as TAMECAT... with modular components designed to facilitate data exfiltration and remote control.
For long-term data-driven access, they deploy a sophisticated PowerShell-based backdoor known as TAMECAT... with modular components designed to facilitate data exfiltration and remote control.
Iran APT SpearSpecter Uses Weeks-Long WhatsApp Lures and Fileless TAMECAT Backdoor to Hit Defense
“GreenCharlie’s toolset centers on a multi-stage PowerShell-based malware framework, including variants known as GORBLE, TAMECAT, and POWERSTAR.”
Analysis of recent campaigns introduces TameCat, a modular, PowerShell-based backdoor used to target senior defense and government officials.
39 distinct techniques documented for this family, organized by ATT&CK tactic.
Upon execution, it immediately queries the target device’s installed antivirus software list via WMI
The module executes arbitrary shell commands via a cmd.exe /c wrapper.
The batch file contains obfuscated PowerShell that fetches further payloads and runs them in memory, minimizing disk artifacts and reducing detection risk.
If the victim clicks the shortcut, it silently runs a command shell that uses curl to fetch and run a batch script from Cloudflare Workers.
configured to run at every logon via the per-user UserInitMprLogonScript registry key.
Command Obfuscation : Utilizes ambiguous expressions to replace plaintext execution commands, evading script detection mechanisms; AES Double Encryption : Core code is first Base64-encoded, then subjected to high-strength encryption
This remote share displays a malicious LNK file (shortcut) to the victim, disguised as a PDF.
Fileless Execution : Operates entirely in memory without writing any malicious files to disk, making detection by traditional antivirus software extremely difficult.
decrypts the assembled blob, and runs the result entirely in memory
collecting the OS and its version, hostname and domain, user and privilege level
The Processes Module captures runtime process state, including process trees, command lines, and loaded modules
The Information module fingerprints the host for targeting by collecting the OS and its version, hostname and domain, user and privilege level, network configuration, uptime, and patch status.
The TAMECAT FileCrawler module builds a quiet staging queue of target files before exfiltration.
the backdoor selectively gathers high-value artifacts such as documents, browser data, system general information, and screenshots.
The TAMECAT Shell module was used to perform targeted collection of Outlook mailboxes.
Payloads are split into dozens of base64 shards, reassembled at runtime, decrypted in memory, and executed through wildcard command resolution.
the attacker deployed three distinct C2 channels: HTTPS, Discord, and Telegram.
The SpearSpecter campaign was the first recorded instance of APT42 using Telegram and Discord as C2.
TAMECAT can also exfiltrate data over FTP as an alternate transport alongside HTTPS and the other C2 channels.
29 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A modular, fileless malware that uses VBScript phishing and PowerShell-based staged delivery, decrypts payloads in memory, steals browser credentials and system information, captures screenshots, receives commands via Telegram bots, and exfiltrates encrypted data through C2 channels including dedicated servers, Discord, and Telegram.
A modular backdoor implemented in PowerShell, used for targeted intrusions against senior defense and government officials.
PowerShell-based backdoor used in long-term espionage that steals credentials from Edge/Chrome (via browser debugging), performs host reconnaissance, persists via files in %LocalAppData%, and exfiltrates data encrypted over HTTPS/Telegram/Discord-based C2.
PowerShell in-memory backdoor used by APT42 for surveillance, credential theft, screen capture, keylogging, reconnaissance, and exfiltration over multiple C2 channels.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.