Loading malware…
TAMECAT is a modular PowerShell-based backdoor used in cyber-espionage operations attributed to the Iranian threat actor APT42, also associated with broader reporting on GreenCharlie and SpearSpecter activity. It is designed for long-term access, remote tasking, reconnaissance, credential and browser-data theft, screenshot capture, file collection, and staged data exfiltration while minimizing forensic artifacts through largely in-memory execution and heavy obfuscation.
Observed intrusion chains rely on targeted social engineering rather than broad spam. Delivery has included spearphishing and relationship-based lures sent through email and WhatsApp, as well as malicious links that abuse Windows search-ms and WebDAV to expose a shortcut disguised as a document. Other reporting describes an initial VBScript stage that performs environment checks, including antivirus discovery via WMI or VBScript queries, and then launches PowerShell or alternate retrieval logic depending on the host environment.
TAMECAT uses a multi-stage, modular architecture. Loader components retrieve additional encrypted or encoded content, decode it, and execute follow-on modules in memory. The malware employs obfuscation techniques such as fragmented Base64 payloads, runtime string reconstruction, wildcard command resolution, and AES-encrypted content and communications. Command-and-control has been observed over HTTPS and, in newer campaigns, through Telegram and Discord, with encrypted tasking and exfiltration workflows. Reporting also describes redundant exfiltration support, including chunked transfer of stolen data and, in some cases, FTP-based upload.
Its collection modules perform host reconnaissance, enumerate installed software and security products, gather system and network details, search for targeted files, capture screenshots, and access Outlook mailbox data. Browser-focused modules target Microsoft Edge and Google Chrome by abusing Edge remote debugging and suspending Chrome to access credential and cookie stores. Stolen information can include login credentials, cookies, browsing-related data, documents, archives, images, media, and other files of intelligence value.
Persistence has been achieved through per-user autorun mechanisms and logon-script style execution, alongside storage of victim identifiers and configuration data on the host. The malware also makes extensive use of legitimate Windows components and trusted binaries to blend activity with normal system behavior. Overall, TAMECAT is a stealth-oriented espionage backdoor tailored for high-value Windows targets, especially senior government, defense, policy, and related individuals and organizations of interest to Iranian intelligence collection.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
TAMECAT has used Windows Management Instrumentation (WMI) to check for anti-virus products.
APT42, an Iran-linked cyber espionage group, has expanded its phishing operations with AI-assisted research, convincing personas, and a more resilient version of its TAMECAT malware.
For long-term data-driven access, they deploy a sophisticated PowerShell-based backdoor known as TAMECAT... with modular components designed to facilitate data exfiltration and remote control.
Iran APT SpearSpecter Uses Weeks-Long WhatsApp Lures and Fileless TAMECAT Backdoor to Hit Defense
“GreenCharlie’s toolset centers on a multi-stage PowerShell-based malware framework, including variants known as GORBLE, TAMECAT, and POWERSTAR.”
Analysis of recent campaigns introduces TameCat, a modular, PowerShell-based backdoor used to target senior defense and government officials.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
This remote share displays a malicious LNK file (shortcut) to the victim, disguised as a PDF.
decrypts the assembled blob, and runs the result entirely in memory
collecting the OS and its version, hostname and domain, user and privilege level
The Processes Module captures runtime process state, including process trees, command lines, and loaded modules
The Information module fingerprints the host for targeting by collecting the OS and its version, hostname and domain, user and privilege level, network configuration, uptime, and patch status.
The malware can collect browser cookies and credentials, search for files
the backdoor selectively gathers high-value artifacts such as documents, browser data, system general information, and screenshots.
The malware can collect browser cookies and credentials, search for files, capture screenshots
Payloads are split into dozens of base64 shards, reassembled at runtime, decrypted in memory, and executed through wildcard command resolution.
send it out through several channels, including HTTPS, Discord, and Telegram
TAMECAT can also exfiltrate data over FTP as an alternate transport alongside HTTPS and the other C2 channels.
55 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
TAMECAT is a multi-function malware used in APT42 phishing campaigns. It is delivered via a WebDAV-hosted LNK/command chain and can collect browser cookies and credentials, search for files, capture screenshots, access Outlook mailbox data, run commands, package stolen information, and exfiltrate data over channels including HTTPS, Discord, and Telegram.
A modular, fileless malware that uses VBScript phishing and PowerShell-based staged delivery, decrypts payloads in memory, steals browser credentials and system information, captures screenshots, receives commands via Telegram bots, and exfiltrates encrypted data through C2 channels including dedicated servers, Discord, and Telegram.
A modular backdoor implemented in PowerShell, used for targeted intrusions against senior defense and government officials.
PowerShell-based backdoor used in long-term espionage that steals credentials from Edge/Chrome (via browser debugging), performs host reconnaissance, persists via files in %LocalAppData%, and exfiltrates data encrypted over HTTPS/Telegram/Discord-based C2.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.