SOC Prime Bias: Critical

10 Nov 2025 21:09
newspaper icon Picus Security

Ferocious Kitten APT Exposed: Inside the Iran-Focused Espionage Campaign

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
Ferocious Kitten APT Exposed: Inside the Iran-Focused Espionage Campaign
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Analysis

Ferocious Kitten is an Iran‑focused cyber‑espionage group active since at least 2015. It delivers weaponised Microsoft Office documents via spear‑phishing to install a custom implant called MarkiRAT, which performs keylogging, screenshot capture, credential harvesting, and staged exfiltration over HTTP(S). The group uses persistence techniques such as shortcut hijacking of Telegram and Chrome, masquerades files with the Right‑to‑Left Override Unicode trick, and abuses Windows BITS for download and proxy discovery. It also leverages the MSHTML RCE vulnerability CVE‑2021‑40444 to deliver a PowerShell stealer.

Investigation

Analysts should map the observed behaviours to MITRE ATT&CK techniques such as T1566.001 (Spearphishing Attachment), T1204.002 (User Execution), T1574 (Hijack Execution Flow), T1036.002 (Masquerading – RTLO), T1197 (BITS Jobs), T1518.001 (Software Discovery – security tools), T1056.001 (Keylogging), and T1071.001 (Web Protocol C2). Indicators of compromise include malicious Office macros that write “update.exe” to the Public folder, shortcuts renamed to point to the malware, BITS job names like “pdj”, HTTP GET/POST to C2 URLs containing parameters “u”, “k”, and exfiltrated file extensions (e.g., .kdbx, .gpg). Network traffic to suspicious domains hosting PowerShortShell or MarkiRAT payloads should be logged.

Mitigation

Deploy layered defenses: enable macro block or allow‑list only trusted Office files, use email security gateways to scan attachments, enforce least‑privilege execution policies, monitor and restrict use of bitsadmin, disable shortcut hijacking by securing %APPDATA% shortcuts, deploy endpoint detection and response (EDR) to detect MarkiRAT behaviours (process injection, file writes to %PUBLIC%\AppData\Libs, keylogging), and keep systems patched for CVE‑2021‑40444 and any later vulnerabilities. Regularly audit installed security products for tampering reports.

Response

When an infection is suspected, isolate the endpoint, collect volatile memory, file system, and Windows event logs, capture the BITS job list, and identify malicious shortcuts. Remove the MarkiRAT binaries, delete associated scheduled jobs and startup entries, and reset compromised credentials. Conduct threat‑intel lookup on C2 domains, update detection signatures, and notify appropriate stakeholders. Perform a post‑incident review to improve user awareness and harden macro handling.

“`mermaid graph TB %% Class definitions classDef action fill:#99ccff classDef technique fill:#ffcc99 classDef malware fill:#ff9999 classDef process fill:#ccffcc %% Nodes attack_initial_access[“<b>Action</b> – <b>T1566.001 Phishing: Spearphishing Attachment</b><br/><b>Description</b>: Email with a weaponized Office document containing macros is sent to the victim.”] class attack_initial_access action malware_markirat[“<b>Malware</b> – <b>Name</b>: MarkiRAT<br/><b>Description</b>: Remote Access Trojan that copies itself into legitimate application directories and establishes C2 communications.”] class malware_markirat malware tech_shortcut_mod[“<b>Technique</b> – <b>T1547.009 Shortcut Modification</b><br/><b>Description</b>: Creates or modifies shortcuts so malicious code runs when the legitimate application starts.”] class tech_shortcut_mod technique tech_masquerade[“<b>Technique</b> – <b>T1036.002 Masquerading: Right-to-Left Override</b><br/><b>Description</b>: Uses Unicode RTL characters in filenames to appear as harmless media files.”] class tech_masquerade technique tech_bits_jobs[“<b>Technique</b> – <b>T1197 BITS Jobs</b><br/><b>Description</b>: Leverages Background Intelligent Transfer Service to create jobs that download additional payloads and gather proxy information.”] class tech_bits_jobs technique tech_process_disc[“<b>Technique</b> – <b>T1057 Process Discovery</b><br/><b>Description</b>: Enumerates running processes to locate security products.”] class tech_process_disc technique tech_software_disc[“<b>Technique</b> – <b>T1518 Software Discovery</b><br/><b>Description</b>: Checks for installed antivirus products such as Kaspersky or Bitdefender and reports findings.”] class tech_software_disc technique tech_clipboard[“<b>Technique</b> – <b>T1115 Clipboard Data</b><br/><b>Description</b>: Captures clipboard contents and keypresses, stores them locally for later exfiltration.”] class tech_clipboard technique tech_data_obf[“<b>Technique</b> – <b>T1001 Data Obfuscation</b><br/><b>Description</b>: Encodes HTTP/S GET/POST parameters to hide malicious traffic.”] class tech_data_obf technique tech_web_service[“<b>Technique</b> – <b>T1102 Web Service</b><br/><b>Description</b>: Uses legitimate web services over HTTP/S for beaconing, command receipt and data exfiltration.”] class tech_web_service technique tech_bidirectional[“<b>Technique</b> – <b>T1102.002 Web Service: Bidirectional Communication</b><br/><b>Description</b>: Maintains two‑way channel with C2 for sending commands and receiving data.”] class tech_bidirectional technique tech_external_proxy[“<b>Technique</b> – <b>T1090.002 Proxy: External Proxy</b><br/><b>Description</b>: Routes C2 traffic through an external proxy discovered via BITS jobs.”] class tech_external_proxy technique %% Connections attack_initial_access –>|delivers| malware_markirat malware_markirat –>|establishes persistence via| tech_shortcut_mod malware_markirat –>|evades detection with| tech_masquerade malware_markirat –>|creates| tech_bits_jobs tech_bits_jobs –>|downloads additional payloads and gathers proxy info| tech_external_proxy malware_markirat –>|performs| tech_process_disc malware_markirat –>|performs| tech_software_disc malware_markirat –>|collects| tech_clipboard malware_markirat –>|obfuscates traffic with| tech_data_obf malware_markirat –>|communicates using| tech_web_service tech_web_service –>|supports| tech_bidirectional tech_bidirectional –>|enables two‑way C2| malware_markirat “`

Attack Flow

Simulation Instructions

Attack Narrative & Commands:

    1. Delivery: An email attachment (update.exe) is dropped into the victim’s C:\Users\Public\ directory.
    2. Execution: The attacker, using a malicious macro or script, runs cmd.exe /c "C:\Users\Public\update.exe" which launches the payload.
    3. Persistence: Because the file resides in the Public folder, any user can re‑execute it, satisfying the boot‑or‑logon autostart technique.
    4. Logging Impact: Sysmon records an event where Image = C:\Windows\System32\cmd.exe and CommandLine contains "/c C:\Users\Public\update.exe"; the detection rule matches on the /c fragment and the known malicious image path (update.exe).

  • Regression Test Script: The script below replicates the attacker’s steps on a test machine.

    # -------------------------------------------------
# Ferocious Kitten simulated payload deployment
# -------------------------------------------------
# 1. Create a dummy malicious executable (placeholder)
$maliciousPath = "$env:PUBLIC\update.exe"
Set-Content -Path $maliciousPath -Value "This is a mock payload" -Encoding ASCII

# 2. Execute the payload via cmd.exe with /c flag
$cmd = "$env:windir\System32\cmd.exe"

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free