Operation ShadowCat is a sophisticated cyber espionage campaign attributed to a suspected Russian-speaking hacker group. The operation primarily targets individuals involved with Indian political affairs by distributing malicious files disguised as documents related to Indian parliamentary proceedings. These deceptive files, often in the form of .LNK shortcuts that appear to be legitimate Office documents, serve as the initial point of attack, leading to the installation of a stealthy Remote Access Trojan (RAT) on the victim’s machine.
Once the malicious .LNK file is executed, it triggers a PowerShell command that downloads and runs a .NET loader. This loader acts as a conduit for delivering the final payload—a RAT written in the Go programming language. The RAT enables attackers to establish persistent control over the compromised systems, allowing them to deploy additional malware such as ransomware and exfiltrate sensitive data.
The attackers behind ShadowCat employ advanced evasion techniques to avoid detection. They use steganography to hide malicious payloads within PNG images hosted on Content Delivery Networks (CDNs), embedding Gzip-compressed code within these images. This method ensures the malicious code remains concealed until runtime, circumventing traditional security measures. Additionally, the RAT deployment involves APC injection into the PowerShell.exe process, allowing the malware to execute discreetly using the host system’s resources.
The targeted nature of the campaign, focusing on individuals connected to Indian political matters, suggests a strategic effort to obtain sensitive information and potentially influence political narratives. The attackers have also implemented geo-location-based execution prevention, avoiding regions with Russian-speaking communities. To mitigate such threats, it is crucial for organizations and individuals to enhance email security protocols, deploy advanced endpoint protection, and educate users on phishing and social engineering risks.
