Malware

Kothamine Agent

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

24 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195.002Compromise Software Supply ChainEvidence2

Kothamine [is] linked to malicious npm packages, which could put users and developers who install those packages at risk.

Execution

4 techniques

T1053.005Scheduled TaskEvidence1

Creates up.ps1 in %TEMP% for persistence... Register-ScheduledTask 'MicrosoftEdgeUpdateTask' -Action $A -Trigger $T -RunLevel Limited -Force.

T1059.001PowerShellEvidence2

The agent ... runs PowerShell commands to add the executable and DLL to the Windows Defender exclusion list.

T1059.003Windows Command ShellEvidence2

exec, shell_exec Executes shell commands with _popen() and send the output back.

T1129Shared ModulesEvidence2

load_feature Writes and loads a base-64 encoded DLL received. The DLL is loaded using LoadLibraryA, and the 'GetFeatureApi' method, resolved via GetProcAddress, is executed.

Persistence

1 technique

T1053.005Scheduled TaskEvidence1

Creates up.ps1 in %TEMP% for persistence... Register-ScheduledTask 'MicrosoftEdgeUpdateTask' -Action $A -Trigger $T -RunLevel Limited -Force.

Privilege Escalation

3 techniques

T1053.005Scheduled TaskEvidence1

Creates up.ps1 in %TEMP% for persistence... Register-ScheduledTask 'MicrosoftEdgeUpdateTask' -Action $A -Trigger $T -RunLevel Limited -Force.

T1055Process InjectionEvidence2

Injects the agent DLL into explorer.exe using OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, and LoadLibraryA.

T1548.002Bypass User Account ControlEvidence2

Some versions bypass User Account Control (UAC) using fodhelper.exe to run elevated.ps1.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence2

Recent versions decrypt strings inline or through functions that use XOR with a different key for each string.

T1036MasqueradingEvidence2

Copies itself to %ROAMING%\MicrosoftEdgeUpdateCore.exe [and] extracts the agent DLL to %ROAMING%\MicrosoftEdgeUpdateCore.dll.

T1055Process InjectionEvidence2

Injects the agent DLL into explorer.exe using OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, and LoadLibraryA.

Credential Access

2 techniques

T1539Steal Web Session CookieEvidence1

These allow operators to: Steal cookies from various browsers.

T1555.003Credentials from Web BrowsersEvidence1

getdiscord, getsessions ... allow operators to: Steal cookies from various browsers.

Discovery

4 techniques

T1016System Network Configuration DiscoveryEvidence2

ipconfig Executes the 'ipconfig /all' command and returns the result.

T1057Process DiscoveryEvidence2

tasklist, kill Returns the processes obtained via 'tasklist /FO CSV /NH'.

T1082System Information DiscoveryEvidence2

sysinfo / systeminfo, curpid Return system information, such as PID, current path, hostname, and OS.

T1083File and Directory DiscoveryEvidence2

mkdir, rmdir, cp, mv, cd, ls, dir, pwd Interacts with files and folders on the system.

Collection

4 techniques

T1113Screen CaptureEvidence2

The version uploaded to GitHub includes additional commands including ... screenshot, screenshare.

T1115Clipboard DataEvidence2

These allow operators to ... Access clipboard contents.

T1123Audio CaptureEvidence2

The version uploaded to GitHub includes additional commands including ... camera ... [to] record through the camera and microphone.

T1125Video CaptureEvidence2

The version uploaded to GitHub includes additional commands including ... camera ... [to] record through the camera and microphone.

Command and Control

4 techniques

T1095Non-Application Layer ProtocolEvidence1

Kothamine uses socket functions to connect to 127.0.0.1:18080, where tailcat is listening.

T1105Ingress Tool TransferEvidence2

Depending on the build, the malware includes the networking tools or downloads them from sources including GitHub... Earlier versions ... downloaded and ran the [Tailscale] installer ... or downloaded the required files directly from GitHub.

T1572Protocol TunnelingEvidence1

tailcat uses Tailscale’s data plane (WireGuard, NAT traversal and DERP) ... Kothamine uses socket functions to connect to 127.0.0.1:18080, where tailcat is listening.

T1573Encrypted ChannelEvidence2

Kothamine ... uses tailcat ... to receive commands over an encrypted connection... The messages exchanged with the C2 are encrypted and decrypted using AES-GCM.

Other

1 technique

T1562.001Disable or Modify ToolsEvidence2

Adds Windows Defender exclusions using PowerShell... Add-MpPreference -ExclusionPath ... Add-MpPreference -ExclusionProcess.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Sep 25, 2026

Kothamine malware uses Tailscale’s tailcat to evade network detection - Malware News - Malware Analysis, News and Indicators

Windows remote-access Trojan composed commonly of an injector and an agent DLL. It injects into explorer.exe, establishes scheduled-task persistence, adds Microsoft Defender exclusions, and receives AES-GCM-encrypted commands over a local socket forwarded through tailcat; older versions used Tailscale VPN. It executes shell commands, manages processes and files, and dynamically loads operator-supplied DLL features. Certain builds include UAC bypass and data-stealing capabilities, including browser cookies, Discord/session data, gaming-related files, screenshots, camera/microphone recording, and clipboard access.

malwarebytes labsNews

Sep 25, 2026

Kothamine malware uses Tailscale’s tailcat to evade network detection | Malwarebytes

A Windows remote-access Trojan comprising an injector and an agent DLL. It injects into explorer.exe, establishes persistence through a scheduled task, adds Microsoft Defender exclusions, and receives encrypted C2 commands through tailcat or, in earlier versions, Tailscale VPN. It can execute shell commands, manipulate files and processes, load arbitrary DLL plugins, and—depending on the build—steal browser cookies, gaming-related files, clipboard data, screenshots, and camera/microphone recordings. It was distributed or linked to malicious npm packages.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping24

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Kothamine Agent

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

24 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195.002Compromise Software Supply ChainEvidence2

Kothamine [is] linked to malicious npm packages, which could put users and developers who install those packages at risk.

Execution

4 techniques

T1053.005Scheduled TaskEvidence1

Creates up.ps1 in %TEMP% for persistence... Register-ScheduledTask 'MicrosoftEdgeUpdateTask' -Action $A -Trigger $T -RunLevel Limited -Force.

T1059.001PowerShellEvidence2

The agent ... runs PowerShell commands to add the executable and DLL to the Windows Defender exclusion list.

T1059.003Windows Command ShellEvidence2

exec, shell_exec Executes shell commands with _popen() and send the output back.

T1129Shared ModulesEvidence2

load_feature Writes and loads a base-64 encoded DLL received. The DLL is loaded using LoadLibraryA, and the 'GetFeatureApi' method, resolved via GetProcAddress, is executed.

Persistence

1 technique

T1053.005Scheduled TaskEvidence1

Creates up.ps1 in %TEMP% for persistence... Register-ScheduledTask 'MicrosoftEdgeUpdateTask' -Action $A -Trigger $T -RunLevel Limited -Force.

Privilege Escalation

3 techniques

T1053.005Scheduled TaskEvidence1

Creates up.ps1 in %TEMP% for persistence... Register-ScheduledTask 'MicrosoftEdgeUpdateTask' -Action $A -Trigger $T -RunLevel Limited -Force.

T1055Process InjectionEvidence2

Injects the agent DLL into explorer.exe using OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, and LoadLibraryA.

T1548.002Bypass User Account ControlEvidence2

Some versions bypass User Account Control (UAC) using fodhelper.exe to run elevated.ps1.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence2

Recent versions decrypt strings inline or through functions that use XOR with a different key for each string.

T1036MasqueradingEvidence2

Copies itself to %ROAMING%\MicrosoftEdgeUpdateCore.exe [and] extracts the agent DLL to %ROAMING%\MicrosoftEdgeUpdateCore.dll.

T1055Process InjectionEvidence2

Injects the agent DLL into explorer.exe using OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, and LoadLibraryA.

Credential Access

2 techniques

T1539Steal Web Session CookieEvidence1

These allow operators to: Steal cookies from various browsers.

T1555.003Credentials from Web BrowsersEvidence1

getdiscord, getsessions ... allow operators to: Steal cookies from various browsers.

Discovery

4 techniques

T1016System Network Configuration DiscoveryEvidence2

ipconfig Executes the 'ipconfig /all' command and returns the result.

T1057Process DiscoveryEvidence2

tasklist, kill Returns the processes obtained via 'tasklist /FO CSV /NH'.

T1082System Information DiscoveryEvidence2

sysinfo / systeminfo, curpid Return system information, such as PID, current path, hostname, and OS.

T1083File and Directory DiscoveryEvidence2

mkdir, rmdir, cp, mv, cd, ls, dir, pwd Interacts with files and folders on the system.

Collection

4 techniques

T1113Screen CaptureEvidence2

The version uploaded to GitHub includes additional commands including ... screenshot, screenshare.

T1115Clipboard DataEvidence2

These allow operators to ... Access clipboard contents.

T1123Audio CaptureEvidence2

The version uploaded to GitHub includes additional commands including ... camera ... [to] record through the camera and microphone.

T1125Video CaptureEvidence2

The version uploaded to GitHub includes additional commands including ... camera ... [to] record through the camera and microphone.

Command and Control

4 techniques

T1095Non-Application Layer ProtocolEvidence1

Kothamine uses socket functions to connect to 127.0.0.1:18080, where tailcat is listening.

T1105Ingress Tool TransferEvidence2

T1572Protocol TunnelingEvidence1

tailcat uses Tailscale’s data plane (WireGuard, NAT traversal and DERP) ... Kothamine uses socket functions to connect to 127.0.0.1:18080, where tailcat is listening.

T1573Encrypted ChannelEvidence2

Kothamine ... uses tailcat ... to receive commands over an encrypted connection... The messages exchanged with the C2 are encrypted and decrypted using AES-GCM.

Other

1 technique

T1562.001Disable or Modify ToolsEvidence2

Adds Windows Defender exclusions using PowerShell... Add-MpPreference -ExclusionPath ... Add-MpPreference -ExclusionProcess.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Sep 25, 2026

Kothamine malware uses Tailscale’s tailcat to evade network detection - Malware News - Malware Analysis, News and Indicators

malwarebytes labsNews

Sep 25, 2026

Kothamine malware uses Tailscale’s tailcat to evade network detection | Malwarebytes

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping24

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.