MarkiRATMalware
MarkiRAT is a remote access Trojan (RAT) compiled with Visual Studio that has been used by Ferocious Kitten since at least 2015.From MITRE ATT&CK
Last reported 2 months ago, by AhnLab ASEC3 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1684Social Engineering
“…rs and financially motivated attackers are employing a combination of supply chain attacks, account takeovers, cloud breaches, and social engineering techniques.”
- T1036Masquerading
“…hly likely a component of Iran’s broader surveillance ecosystem, using MarkiRAT malware distributed through fake Android applications masquerading as legitimate services such as VPNs and media tools to collect intelligence from Iranian targets.”
- T1105Ingress Tool Transfer
“Script-based execution (such as PowerShell, VBScript, CMD, and JavaScript), obfuscation, ingress tool transfer, HTTP/HTTPS-based C2 communication, local system data collection, and data exfiltration via C2 paths were repeatedly observed.”
- T1195Supply Chain Compromise
“A compromised supplier may expose customer identities and trusted administrative paths, but it’s only a software supply-chain compromise if there is evidence that downstream customers, builds, updates, or distribution were affected.”
- T1221Template Injection
“Viceroy Tiger (Donot) targeted Bangladeshi military and defense officials using remote template injection and a multi-stage shellcode loader.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
July 2026 Threat Trend Report on APT Groups“TAG-182 used fake VPNs and media players to induce MarkiRAT infections.”
-
Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters“…es turn to VPNs, media players, and utilities from informal channels, and recent TAG-182 activity used exactly such lures to distribute MarkiRAT to Farsi-speaking users inside and outside Iran.”
-
Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool“Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool”
Thanks — we review every report.