APT42’s TAMECAT Malware Fuels Long-Term Espionage Against Government and Defense Targets

February 23, 2026•3 min read

Security researchers have uncovered new details about TAMECAT, a modular malware framework used by APT42 in sustained espionage campaigns targeting senior government and defense officials.

Analysis from Israel’s National Digital Agency, supported by findings from Pulsedive, reveals a carefully engineered infection chain that blends social engineering, adaptive execution, encrypted command-and-control, and in-memory credential theft — all designed to evade detection while maintaining long-term access.

This is not smash-and-grab malware.
It is patient, persistent, and purpose-built for intelligence collection.

🎭 Initial Compromise: Social Engineering First

APT42 operations begin long before malware execution.

The group establishes trust with targets through tailored social engineering, then delivers a VBScript-based downloader that adapts to the victim’s environment.

The initial script:

Uses WMI queries to enumerate installed antivirus products
Dynamically selects execution paths based on defenses present

If Windows Defender is detected:

PowerShell is launched via conhost
wget retrieves the next-stage loader

If not:

The malware falls back to cmd.exe and curl to fetch an alternate payload

This conditional logic ensures execution succeeds across diverse environments.

⚙️ Loader Design: Encrypted, Layered, and Stealthy

The loader (nconf.txt) relies on AES-encrypted payloads and layered obfuscation.

Key characteristics include:

Custom decryption routines (“Gorba” and “Borjol”)
Bitwise transformations and UTF-8 decoding
Removal of leading bytes from base64 URLs to evade detection

Once decrypted, the loader:

Generates a unique victim ID stored in %LocalAppData%\config.txt
Collects OS details and host identifiers
Encrypts data using AES-256
Exfiltrates information via HTTPS POST requests with custom headers

Command-and-control traffic is sent to attacker infrastructure using legitimate web protocols, blending seamlessly into normal traffic.

📡 Command-and-Control via Telegram and Web Services

TAMECAT receives commands through:

Telegram bots
Supplementary platforms such as Discord

C2 responses include:

Command language (PowerShell or C#)
Base64-encoded instructions
Execution flags and thread control

Commands are executed entirely in memory, leaving minimal forensic artifacts.

🔓 Credential Theft Without Disk Writes

One of TAMECAT’s most advanced capabilities is its browser credential harvesting.

The malware:

Suspends Chrome processes
Leverages Microsoft Edge’s remote debugging protocol
Dumps credentials directly from browser memory

A fake Chrome directory is created under %LocalAppData% to stage operations, allowing attackers to extract:

Saved usernames and passwords
Session data

No malicious files are written to disk during credential theft, significantly reducing detection opportunities.

🧬 Shared DNA with Known Espionage Tooling

Researchers observed obfuscation patterns shared with PowerStar variants, including:

Fragmented arrays
String replacement techniques
Wildcard-based obfuscation

The malware also mimics legitimate browser user-agents (e.g., Chrome 119), further blending into normal activity.

🧭 MITRE ATT&CK Mapping Highlights

TAMECAT aligns with multiple ATT&CK techniques, including:

T1059.001 – PowerShell execution
T1547 – Boot or Logon Autostart (suspected persistence)
T1555 – Credential access from password stores
T1071.001 – Web-based C2 communications
T1027 – Obfuscated files and information

🛡️ Defensive Recommendations

Elliptic Systems recommends layered defenses focused on behavior, not signatures:

Deploy EDR and AV capable of detecting process chains (e.g., wscript → PowerShell)
Enable PowerShell Script Block Logging
Restrict execution to signed PowerShell scripts only
Monitor for:
- VBScript launching interpreters
- Abnormal browser debugging activity
- Suspended browser processes
Harden browser credential storage and logging