Inside TAMECAT: A Closer Look at APT42’s Stealthy PowerShell Backdoor

During recent investigations into Iranian state by cyber activity and security researchers uncovered TAMECAT, a highly stealthy PowerShell-based backdoor linked to APT42. Known for long-term espionage and carefully crafted social engineering campaigns, APT42 continues to demonstrate how modern nation state malware blends deception, modularity, and legitimate system tools to stay under the radar.

TAMECAT is not designed for noisy infections or quick financial gain. Instead, it quietly embeds itself into victim environments, focusing on intelligence collection particularly browser credentials while maintaining resilient command-and-control access.

APT42 and the Human Element of Intrusion

APT42’s operations typically begin long before malware ever touches a system. The group invests heavily in social engineering, building trust with targets often senior government and defense officials through seemingly benign interactions. Only after establishing credibility does the technical compromise occur.

TAMECAT plays a key role in this phase, acting as a long-term access tool once the victim system is breached.

From Script to Backdoor: How Infection Begins

The infection chain starts with a VBScript downloader, identified by the following hash:

SHA256: 5404e39f2f175a0fc993513ee52be3679a64c69c79e32caa656fbb7645965422

Before doing anything malicious, the script performs environment awareness checks. Using WMI queries, it enumerates installed antivirus products and adapts its behavior accordingly:

• If “Windows” is detected in the AV list, it launches PowerShell via conhost and uses wget to retrieve the next-stage loader.
• If not, it falls back to cmd.exe and curl, pulling an alternate payload.

This simple but effective branching logic helps TAMECAT survive across different defensive setups.

Peeling Back the Loader’s Layers

The loader, disguised as nconf.txt, is where TAMECAT’s sophistication becomes obvious:

SHA256: bd1f0fb085c486e97d82b6e8acb3977497c59c3ac79f973f96c395e7f0ca97f8

Rather than embedding its functionality directly, the loader relies on AES-encrypted payloads and custom decryption routines. Two notable functions stand out:

Gorba, responsible for AES decryption using the key: T2r0y1M1e1n1o0w1

Borjol, which further processes and reconstructs the decrypted content

To complicate analysis, the script strips bytes from base64 encoded URLs, downloads additional files such as df32s.txt, and applies bitwise operations combined with UTF-8 transformations before revealing the actual code.

Talking to the Operator: C2 Communication

Once active, TAMECAT establishes encrypted communication with its command-and-control infrastructure, most notably:

• accurate-sprout-porpoise[.]glitch[.]me

Victim systems generate a unique identifier, stored locally in %LocalAppData%\\config.txt, and begin sending system information including OS details and computer name. A hardcoded campaign token (GILNH9LX6TCZ9V8ZZSUF) is included in every beacon.

All collected data is encrypted using AES-256 via a routine named Borpos, with the initialization vector transmitted in a custom HTTP header (Content-DPR). Commands returned from the C2 server are separated by a distinctive ¶ delimiter and include execution language, encoded instructions, and control flags.

Telegram bots are used as the primary command channel, with platforms like Discord observed as fallback options — giving operators flexibility and redundancy.

Silent Credential Theft via Browser Abuse

One of TAMECAT’s most impactful capabilities is its approach to browser credential theft. Instead of dropping credential-stealing binaries to disk, the malware abuses legitimate browser features:

• Creates Chrome related directories under %LocalAppData%
• Suspends Chrome processes during extraction
• Leverages Microsoft Edge remote debugging protocols
• Dumps saved login credentials directly from browser memory

By operating almost entirely in-memory, TAMECAT significantly reduces forensic artifacts and evades many traditional detection mechanisms.

Obfuscation as a Design Principle

TAMECAT’s PowerShell code is heavily obfuscated using:

• Fragmented arrays
• Wildcard string matching
• Dynamic string replacement

These techniques closely resemble those seen in PowerStar malware variants. Network traffic is further disguised using a realistic Chrome 119 user-agent, helping malicious traffic blend in with normal browsing activity.

Mapping TAMECAT to MITRE ATT&CK

TAMECAT’s behavior aligns with several well-documented ATT&CK techniques:

• T1059.001 — PowerShell execution
• T1547 — Persistence via boot or logon autostart (suspected)
• T1555 — Credential access from browser password stores
• T1071.001 — HTTPS-based command-and-control
• T1027 — Obfuscated files and information

Why TAMECAT Matters?

TAMECAT highlights a broader trend in nation state operations: malware that looks less like traditional “malware” and more like a carefully orchestrated abuse of trusted system functionality. With encrypted communications, in memory execution, and legitimate cloud platforms used for C2, detection becomes a matter of behavioral visibility, not signatures.