Quick links
Press Enter to search, Esc to close
Malware profile
TAMECAT is a PowerShell backdoor that MITRE ATT&CK lists as used by APT42 to run PowerShell or C# content.
In short
TAMECAT is a PowerShell backdoor that MITRE ATT&CK lists as used by APT42 to run PowerShell or C# content. The Israel National Digital Agency describes it as a modular backdoor that runs mostly in memory and collects files, browser data, screenshots and Outlook mail, and says it can talk to its operators over HTTPS, Telegram and Discord.
The Israel National Digital Agency says TAMECAT runs most of its work directly in memory, so little is left on disk. Its loader cycles through a list of command servers until it finds a valid controller payload, and each payload is one module.
The agency says the SpearSpecter campaign was the first recorded case of APT42 using Telegram and Discord as command channels. It says transfers are encrypted with AES-256.
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| TAMECAT | Name of MITRE ATT&CK software S1193 and used in the Israel National Digital Agency SpearSpecter report[1, 2] |
What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Command and Scripting Interpreter: PowerShell T1059.001
It has used PowerShell to download and run additional content.[1]
Command and Scripting Interpreter: Windows Command Shell T1059.003
It has used cmd.exe to run the curl command.[1]
Command and Scripting Interpreter: Visual Basic T1059.005
It has used VBScript to query anti-virus products.[1]
Windows Management Instrumentation T1047
It has used Windows Management Instrumentation (WMI) to query anti-virus products.[1]
Application Layer Protocol: Web Protocols T1071.001
It has used HTTP for command and control.[1]
Ingress Tool Transfer T1105
It has used wget and curl to download additional content.[1]
Data Encoding: Standard Encoding T1132.001
It has encoded command traffic with Base64.[1]
Encrypted Channel: Symmetric Cryptography T1573.001
It has used AES to encrypt command traffic.[1]
The Israel National Digital Agency says the operators send the victim a link that they claim is a required document for an upcoming meeting or conference. The link redirects to a lure on OneDrive, and one redirect abuses the Windows search-ms handler so that Explorer opens an attacker-run WebDAV share holding a shortcut file disguised as a PDF. MITRE does not describe delivery.
The order of steps in a typical infection, as the sources describe it.
Operators spend days or weeks building a relationship with a senior target, then send a link to a document said to be needed for a meeting or conference.[2]
The link redirects to a lure on OneDrive, and one redirect shows a page that abuses the search-ms handler to prompt the user to open Windows Explorer.[2]
If the user agrees, Explorer connects to the attacker's WebDAV server, which shows a shortcut file disguised as a PDF.[2]
Opening the shortcut runs a command shell that uses curl to fetch a batch script from a serverless hosting service.[2]
The batch script runs obfuscated PowerShell in memory and sets up persistence. The loader then cycles through command servers until it finds a valid controller payload.[2]
Each module has one job, such as host details, file lists, browser data, screenshots or Outlook mail. Data goes out over HTTPS, Telegram, Discord or FTP.[2]
The agency describes a campaign that uses TAMECAT, assesses with high confidence that it is run by operators working for or with the IRGC Intelligence Organization, and sets out recommendations.[2]
The Israel National Digital Agency advises turning on PowerShell script block logging, installing Sysmon that reports to a SIEM, using an endpoint detection tool, and building behavior rules from the campaign's techniques, because most payloads run only in memory.[2]
Counters: T1059.001
The agency advises disabling the Windows search-ms protocol handler, which the campaign used to share files without sending them directly.[2]
The agency advises a filtering proxy, a baseline of normal traffic with alerts on change, inspection that can spot the IV in the Sec-Host header, and blocking Telegram and Discord where unused. MITRE advises filtering outbound traffic to unapproved destinations.[2, 5]
The agency advises educating senior employees on how convincing the approaches are, and checking with a known colleague that a person who makes contact is real.[2]
The agency's report lists techniques and attached indicators for a retro hunt in environments of people who may be of interest to the IRGC.[2]
MITRE ATT&CK describes TAMECAT as malware used by APT42 to run PowerShell or C# content. The Israel National Digital Agency describes a modular PowerShell backdoor.
MITRE lists APT42. The Israel National Digital Agency said in November 2025 that it assesses with high confidence that the SpearSpecter campaign, which used TAMECAT, is run by operators working for or with the IRGC Intelligence Organization.
The agency describes a link to a meeting document, a lure on OneDrive, a page that abuses the search-ms handler and a shortcut file disguised as a PDF on an attacker-run WebDAV share.
The agency says it can use HTTPS, Telegram and Discord, with AES-256 encryption, and reports it as the first recorded use of Telegram and Discord by APT42. MITRE lists HTTP and Base64 encoded, AES encrypted traffic.
The agency advises PowerShell script block logging, Constrained Language Mode, application control, a filtering proxy, disabling the search-ms handler and training senior staff.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.