Tamecat | |
Type of Malware | Backdoor |
Country of Origin | Iran |
Date of initial activity | March 2024 |
Targeted Countries | Regions of interest to Iran |
Associated Groups | APT42 |
Motivation | Cybercriminals may use TAMECAT to access files, directories, applications, and more. With this access, threat actors can extract a wide range of sensitive information, including personal data, financial records, login credentials, and other valuable data. Additionally, threat actors may use TAMECAT to inject additional malware into the compromised systems. |
Attack Vectors | Malicious links from typo-squatted domains that are masquerading as news articles likely sent via spear phishing, redirecting the user to fake Google login pages. |
Tools | ExpressVPN nodes, Cloudflare-hosted domains, and ephemeral VPS servers |
Targeted System | Windows |
Overview
In March 2024, Mandiant identified a sample of TAMECAT, a PowerShell toehold capable of executing arbitrary PowerShell or C# content. TAMECAT is delivered by malicious macro documents, communicates with its command-and-control (C2) node via HTTP, and expects data from the C2 to be Base64 encoded. Mandiant previously observed TAMECAT being used in a large-scale APT42 spear-phishing campaign targeting individuals or entities employed by or affiliated with NGOs, governments, or intergovernmental organizations worldwide.
Targets
Credentials of journalists, researchers, and geopolitical entities in regions of interest to Iran. Individuals or entities employed by or affiliated with NGOs, government, or intergovernmental organizations around the world
How they operate
APT42 utilizes two custom backdoors named Nicecurl and Tamecat, each designed for specific functions within cyberespionage operations.
The attack begins with emails from online personas posing as journalists, NGO representatives, or event organizers, sent from domains that “typosquat” (use similar URLs) to those of legitimate organizations.
TAMECAT is delivered with decoy content, likely via spear phishing, providing APT42 operators with initial access to the targets. The backdoor offers a flexible code-execution interface, which can be used as a jumping-off point to deploy additional malware or manually execute commands on the device.
TAMECAT is dropped by malicious macro documents, communicates with its command-and-control (C2) node via HTTP, and expects data from the C2 to be Base64 encoded. Execution begins with a small VBScript downloader that leverages Windows Management Instrumentation (WMI) to query anti-virus products running on the victim’s system. Depending on whether the script detects Windows Defender, different download commands and URLs are used.
