Imperial Kitten APT Profile: TTPs, Malware, and Attack Simulation

Summary

Imperial Kitten is an Iranian state-sponsored APT linked to the IRGC and known for targeting aerospace and defense organizations. The group relies on highly targeted spearphishing campaigns and credential-validated portals to deliver custom malware. Its toolkit includes multiple backdoors, such as TWOSTROKE and MINIBIKE, and frequently uses Microsoft Azure infrastructure for C2 communications.

Investigation

The report traces Imperial Kitten’s evolution from 2017 through 2026, highlighting its shift from supply chain operations toward sophisticated social media catfishing and tailored phishing portals. The analysis also examines custom LLVM-style obfuscation techniques and DLL sideloading methods used to maintain stealth and complicate detection.

Mitigation

Organizations should strengthen email security to identify lookalike domains and verify legitimate authentication workflows. Endpoint defenses should be hardened against DLL sideloading, while unauthorized registry changes in Run keys should be closely monitored. Restricting outbound traffic to approved cloud services can also reduce the risk of C2 communication through Azure infrastructure.

Response

When Imperial Kitten activity is detected, isolate compromised hosts to prevent lateral movement through RDP or SSH tunnels. Conduct forensic analysis of %LOCALAPPDATA% for suspicious DLLs and inspect registry keys for persistence mechanisms. Review Azure-related network traffic for unusual patterns associated with identified C2 domains and tools.

Simulation Execution

• Attack Narrative & Commands: The adversary has successfully gained initial access. To ensure they remain on the system after a reboot, they deploy a loader that adds a “MigAutoPlay” entry into the Current User’s Run registry key. This mimics the Imperial Kitten malware profile. After establishing persistence, the adversary performs lateral movement via RDP. To evade detection and hide their tracks from forensic investigators, they immediately proceed to delete the registry keys that store the history of recently connected RDP servers.

• Regression Test Script:

  # --- PART 1: Persistence Simulation ---
  Write-Host "[+] Simulating Persistence via MigAutoPlay..."
  $PersistencePath = "HKCU:SoftwareMicrosoftWindowsCurrentVersionRun"
  New-ItemProperty -Path $PersistencePath -Name "MigAutoPlay" -Value "C:UsersPublicloader.dll" -PropertyType String -Force
  
  # --- PART 2: Anti-Forensics (RDP Cleanup) Simulation ---
  Write-Host "[+] Simulating RDP History Cleanup..."
  $RDPPath1 = "HKCU:SoftwareMicrosoftTerminal Server ClientDefault"
  $RDPPath2 = "HKCU:SoftwareMicrosoftTerminal Server ClientServers"
  
  # Deleting keys to simulate cleanup
  if (Test-Path $RDPPath1) { Remove-Item -Path $RDPPath1 -Recurse -Force }
  if (Test-Path $RDPPath2) { Remove-Item -Path $RDPPath2 -Recurse -Force }
  
  Write-Host "[!] Simulation Complete."

• Cleanup Commands:

  # Cleanup the persistence key created during simulation
  Remove-ItemProperty -Path "HKCU:SoftwareMicrosoftWindowsCurrentVersionRun" -Name "MigAutoPlay" -ErrorAction SilentlyContinue
  
  # Note: RDP keys are system-managed; we cannot easily restore the 'deleted' history 
  # via script, but we can recreate the empty structures if necessary.
  New-Item -Path "HKCU:SoftwareMicrosoftTerminal Server ClientDefault" -Force | Out-Null
  New-Item -Path "HKCU:SoftwareMicrosoftTerminal Server ClientServers" -Force | Out-Null