Imperial Kitten (Tortoiseshell) APT: TTPs, Malware, and Attack Simulation

Key Takeaways

• Imperial Kitten is an IRGC-linked Iranian APT targeting aerospace and defense sectors globally since 2017.
• The group's phishing portals serve malicious payloads only after validating per-victim credentials, limiting payload exposure significantly.
• Custom LLVM-style obfuscation, dynamic API resolution, and per-string XOR encryption make Imperial Kitten's malware resistant to static analysis.
• Imperial Kitten hosts C2 servers on Microsoft Azure, blending malicious traffic with legitimate cloud activity to avoid detection.
• Every Imperial Kitten backdoor hardcodes three to five fallback C2 servers, maintaining access even after primary servers are blocked.
• Picus Threat Library includes over a dozen Imperial Kitten threats spanning endpoint, network infiltration, and email infiltration attack modules.

Imperial Kitten is an Iranian state-sponsored APT linked to the IRGC, first observed in 2017. The group targets aerospace, defense, and IT organizations across the Middle East, North America, Europe, and the Asia-Pacific region.

Imperial Kitten distinguishes itself through a highly targeted delivery mechanism that validates per-victim credentials before serving malicious payloads, ensuring only the intended recipient receives the archive. The group relies on DLL sideloading through trusted vendor binaries, LLVM-style compiler obfuscation, and Microsoft Azure infrastructure to blend C2 traffic into legitimate network activity.

In this blog, we will cover Imperial Kitten's major activities and TTPs, and show how Picus helps you validate your security controls against this threat.

Simulate APT Attacks with 14-Day Free Trial of Picus Platform

What Are the Major Activities of the Imperial Kitten?

2017-2018 - Becomes active, compromising IT service providers in Saudi Arabia through supply chain attacks.

2020-2021 - Runs a years-long social media catfishing campaign targeting US military personnel and defense contractors through fake personas.

July 2021 - Meta removes approximately 200 fake accounts linked to the group and publicly identifies its connection to a Tehran-based IT company with IRGC ties.

June 2022 - Begins targeting aerospace and defense organizations in Israel and the UAE through fake job offers.

October 2023 - Exploits the Israel-Hamas war with themed lures impersonating the “Bring Them Home Now” hostage return movement.

February 2024 - Imperial Kitten operations across Israel, UAE, Turkey, and India are exposed, including credential harvesting through fake login pages impersonating major defense companies.

April 2024 - The US Department of Justice charges four Iranian nationals and OFAC sanctions the group’s front company, formally linking Imperial Kitten to the IRGC.

February 2026 - Delivers malware through a Trojanized Zoom installer using valid digital certificates to evade detection, in what researchers name “Operation Epic Fury.”

August 2026 - Continued operations expose activity spanning the UAE, Saudi Arabia, the UK, Canada, Australia, and Japan.

Which MITRE ATT&CK Techniques Are Used by Imperial Kitten?

Tactic: Reconnaissance

T1598.003 Phishing for Information: Spearphishing Link

Imperial Kitten used compromised third-party vendor accounts to send password-reset-themed lures that pointed privileged users to attacker-controlled reset portals. The goal of these lures was to collect credentials for accounts with higher permissions inside the primary target.

The group also hosted fake login pages on its job-themed lure sites to harvest credentials. These pages impersonated aerospace, aviation, and thermal-imaging companies (for example, a Boeing-branded careers login and a lookalike thermal-imaging portal on teledyneflir[.]com[.]de), and the same infrastructure also hosted backdoor archives.

Tactic: Initial Access

T1566.002 Phishing: Spearphishing Link

Imperial Kitten sends recruitment emails with a lookalike careers authentication link and blank username and password fields filled for each target. The lure claims the recipient's profile has been forwarded and that the job description will follow login, and the delivered attachments or links run hidden malware.

The group also approaches targets on professional social media platforms posing as an HR specialist, then moves the conversation to email. The follow-up message from a free webmail account contains a job-application link with a per-victim path and a pre-shared username and password (for example, a link under telespazio-careers[.]com/c/) [3].

The link opens a React-based careers portal that impersonates the lure company (for example, Boeing, Airbus, Rheinmetall, or flydubai). The login button posts to the /login-user API, which returns 401 Unauthorized for wrong credentials and otherwise delivers the malicious archive, so only the intended victim receives the payload.

Tactic: Persistence

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Imperial Kitten's loader DLL created a working folder under %LOCALAPPDATA%\Microsoft\MigAutoPlay, copied the backdoor userenv.dll there, and restored the legitimate setup binary to its original name, MigAutoPlay.exe. It then registered that host executable in the current user's Run key, so every logon side-loads the backdoor [3].

Tactic: Stealth

T1027 Obfuscated Files or Information

Imperial Kitten protects its backdoor and browser stealer with compiler-level obfuscation built from custom LLVM-style passes. Almost every call target is computed at runtime from encoded table pointers and large constants, so the disassembly shows only indirect call rax instructions without static cross-references [3].

Conditional branches are also flattened into single jmp rax instructions whose destination depends on runtime state. The code is also padded with repetitive junk blocks that carry no functional logic.

Every string is encrypted separately, with its key stored directly after the ciphertext and its own decryption routine wrapped in opaque predicates. Once the arithmetic noise is removed, each routine reduces to a repeating-key XOR.

A separate backdoor implementation used a lighter scheme, decoding its strings and five embedded C2 hostnames with a single-byte XOR key of 0x55. Its MINIBIKE backdoor also carried string obfuscation and additional obfuscation layers.

T1027.007 Obfuscated Files or Information: Dynamic API Resolution

Imperial Kitten's C++ backdoor resolves its APIs inside DllMain and stores each address in a global map keyed by API name. DLL and API names exist only as encrypted stack strings that a seeded routine decrypts at runtime [1].

T1036.005 Masquerading: Match Legitimate Resource Name or Location

Imperial Kitten names both its reverse SSH utility and its C++ backdoor wtsapi32.dll, the Windows Terminal Server SDK library. Both DLLs forward every legitimate export to the real system library, so the hijacked host keeps working while the malicious code runs.

The group also planted tools inside legitimate VMware Tools folders. The WebSocket tunneler ran as VGAuth.dll beside VGAuthCLI.exe, and the DCSync and browser-credential utilities wrote their output to C:\Program Files\VMware\VMware Tools\VMware VGAuth.

T1070.007 Indicator Removal: Clear Network Connection History and Configurations

Imperial Kitten removed Remote Desktop client history from compromised hosts to hide the systems it had connected to during lateral movement. It deleted both the most-recently-used connection list and the per-server records, which also store saved usernames [2].

T1574.001 Hijack Execution Flow: DLL

Imperial Kitten's C++ backdoor is built as a wtsapi32.dll replacement for DLL search order hijacking, so a legitimate executable loads it from its own directory before System32.

The group used search order hijacking to run almost every post-exploitation tool, including its backdoors, tunnelers, DCSync utility, browser-credential decryptor, and screenshot utility. It abused legitimate Fortinet, VMware, Citrix, Microsoft, and NVIDIA executables, sometimes installing the software after initial access and sometimes planting DLLs into existing installation directories with SYSTEM privileges.

Its delivery chain also uses multi-stage side-loading. The legitimate Setup.exe in the delivery archive side-loads userenv.dll, which checks the host module name. When the host is not MigAutoPlay.exe, it starts the Defender binary SenseSampleUploader.exe through low-level NT APIs [3].

To start it, the DLL builds RTL_USER_PROCESS_PARAMETERS with RtlCreateProcessParameters, sets the DllPath field to the archive directory obtained via GetModuleHandle, and calls RtlCreateUserProcess. SenseSampleUploader.exe imports xmllite.dll by relative path, so the loader falls back to the archive folder and loads the malicious copy.

Tactic: Credential Access

T1056.002 Input Capture: GUI Input Capture

Imperial Kitten uses TRUSTTRAP to collect credentials for lateral movement. The tool shows a fake "Windows Security" dialog titled "Microsoft Outlook" with the message "Connecting to your account" and username and password fields, then saves whatever the user enters to a file in cleartext.

T1555.003 Credentials from Password Stores: Credentials from Web Browsers

The group reached saved browser credentials through live sessions. It identified logged-on users with quser.exe or wmic.exe, connected over RDP with that user's account to reach active, unlocked browser sessions, and used a commercial agentless remote-management tool to copy browser credential files from remote hosts.

Additionally, its lightweight browser stealer comes in Chrome and Edge variants and is injected into the browser as a DLL. It first reports the username and domain to the C2 server in JSON and continues only when the server answers with any status other than 200 [3].

The stealer then uploads each Edge login-data file in a separate multipart POST request. Other versions instead send the JSON records to a named pipe.

Tactic: Lateral Movement

T1534 Internal Spearphishing

After gaining a foothold, Imperial Kitten phished IT staff and administrators from inside the victim's environment to obtain more privileged credentials. It first reviewed older emails in compromised inboxes for legitimate password-reset requests and located internal password-reset pages, then copied those processes in its lures.

An illustrative example of this technique is shown below:

The group also stole victim source code to build convincing internal phishing pages hosted on lookalike domains that passed the victim's proxy controls (for example, mydocs.qatarcentral.cloudapp.azure[.]com).

Tactic: Collection

T1113 Screen Capture

Imperial Kitten deploys a C-based screenshot utility on workstations of users who handle sensitive data or hold privileged access. The tool resolves its GDI and COM functions at runtime and captures the screen at regular intervals.

It names each capture folder after the current timestamp in YYYY-MM-DD-HH-MM format under public user folders and saves screenshots as incrementing JPEG files.

Tactic: Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Imperial Kitten’s backdoors communicate with their controllers over standard HTTPS, blending C2 traffic into normal web activity. The TWOSTROKE backdoor establishes SSL-encrypted connections on TCP/443 using the Windows WinHttp API. After resolving its networking functions at runtime, TWOSTROKE sends a unique victim identifier through an HTTPS POST request to the active C2 server. When the server responds with a 200 status code, the backdoor queries for pending commands and spawns a worker thread to dispatch and execute them [1] [2].

The MiniJunk backdoor follows a similar pattern, using regular HTTPS requests through the Windows API to reach its controllers. C2 responses arrive as encoded strings that the backdoor parses into structured command fields [3].

T1008 Fallback Channels

Imperial Kitten builds redundancy into every implant by hardcoding multiple C2 servers per binary. If one server goes down, the backdoor automatically rotates to the next available server in its list.

The TWOSTROKE sample contained three hardcoded C2 domains: neexportfolio[.]com, neexportfolio.azurewebsites[.]net, and neexportfolio.eastus.cloudapp.azure[.]com [1]. MINIBIKE samples cycling through three to five Azure subdomains in a loop after every communication was seen, and other TWOSTROKE samples were similarly configured with multiple Azure-hosted C2 servers [2] [4]. MiniJunk samples similarly embed between three and five fallback servers [3].

In addition to backdoor-level redundancy, the group deployed alternative remote access tools such as ZEROTIER and NGROK. In some intrusions, these were held in reserve and activated only after victim organizations had carried out remediation actions, serving as a fallback mechanism to retain access [2].

T1102 Web Service

Imperial Kitten makes extensive use of Microsoft Azure cloud infrastructure to host C2 servers, register domains, and route traffic. The group relies on Azure Web Apps (azurewebsites[.]net subdomains), Azure Cloud Apps (cloudapp.azure[.]com subdomains), and traditional registered domains for C2 communication [1] [2] [4]. By hosting C2 servers on a trusted cloud platform, the group makes its traffic difficult to distinguish from legitimate organizational network activity, especially when servers are geolocated in the same countries as the target [4].

In June 2025, the group re-architected its C2 infrastructure to combine Cloudflare and Azure App Service, improving operational resiliency. If one cloud provider or domain was suspended, execution could continue through the remaining infrastructure [3].

Domain naming conventions are selected to appear plausible to network defenders. Earlier campaigns used strings resembling legitimate services or sector-relevant terms (e.g., blogvolleyballstatus[.]azurewebsites[.]net, engineeringrssfeed[.]azurewebsites[.]net) [4]. More recent MiniJunk campaigns shifted to long, health-themed subdomain names on azurewebsites[.]net.

T1572 Protocol Tunneling

Beyond its backdoors, Imperial Kitten relies heavily on reverse SSH tunnels and custom tunneling utilities to maintain C2 access while minimizing host-based forensic evidence.

The group’s reverse SSH utility, masquerading as wtsapi32.dll, executes the built-in Windows OpenSSH client to establish an SSH connection to operator infrastructure on port 443. The tunnel is configured to forward traffic from a specified port on the C2 server back through the encrypted channel into the compromised network [1] [2].

The group also deploys LIGHTRAIL, a custom tunneler likely based on the open-source Lastenzug Socks4a proxy. LIGHTRAIL communicates over WebSocket connections through Azure cloud infrastructure, with the port hardcoded to 443 and the URI path set to /news. It resolves DLLs and API functions using hash-based resolution with a custom XOR value and constructs a hardcoded User-Agent string on the stack [2] [4].

POLLBLEND, another custom C++ tunneler, registers the compromised machine with the C2 by sending a POST request to /register/ containing the computer name in a JSON body [2].

GHOSTLINE, written in Golang, uses the go-yamux multiplexing library for its network connection and communicates over a hardcoded domain [2].

T1132.001 Data Encoding: Standard Encoding

The C2 protocol for each backdoor variant uses its own encoding and parsing scheme. TWOSTROKE commands arrive as hex-encoded payloads separated by the delimiter @##@ and contain the command identifier, which maps to a handler function, along with arguments interpreted by each handler [1] [2].

MiniJunk uses a similar structure with ## as its separator, parsing responses into a vector of strings containing command settings, command ID, and command arguments [3]. DEEPROOT’s C2 responses use the delimiter -===- to separate fields for sleep timeout, command ID, the command itself, and up to two optional arguments [2].

TWOSTROKE’s victim identifier is also derived through encoding: the backdoor retrieves the machine’s fully qualified DNS hostname via GetComputerNameExW and XORs the string with a repeating key (“Pn”).

T1573.001 Encrypted Channel: Symmetric Cryptography

Certain backdoor variants add a layer of encryption on top of HTTPS transport. The separate backdoor cluster tracked through dxgi.dll encrypts its C2 communication and decodes its five embedded C2 hostnames using a single-byte XOR key of 0x55 [3]. Earlier versions in the broader toolset applied simple XOR encryption to network data with short keys [3]. MiniJunk, by contrast, does not encrypt its network data but instead applies a multi-step encoding algorithm: data is collected as a wide string, converted to bytes, reversed at the byte level, and then the entire string is reversed [3].

How Picus Simulates Imperial Kitten Attacks?

We strongly suggest simulating Imperial Kitten Attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Platform. You can also test your defenses against hundreds of other threat groups within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for Imperial Kitten:

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Platform.

What Are the Aliases of the Imperial Kitten Group?

Imperial Kitten is also known as: Tortoiseshell, CURIUM, Crimson Sandstorm, Cuboid Sandstorm, DUSTYCAVE, TA456, Yellow Liderc, UNC1549, Nimbus Manticore.

References

[1] M. Alhmoud and M. Emam, “Tortoiseshell: New Toolset and Operational Infrastructure Exposed,” Group-IB Blog, Aug. 26, 2026. [Online]. Available: https://www.group-ib.com/blog/tortoiseshell-apt-toolset-infrastructure/

[2] M. El-Banna, D. Lee, M. Stokkel, and J. Goddard, “Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem,” Google Cloud Blog, Nov. 17, 2025. [Online]. Available: https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense

[3] Check Point Research, “Nimbus Manticore Deploys New Malware Targeting Europe,” Check Point Research, Sep. 22, 2025. [Online]. Available: https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/

[4] O. Rozmann, C. Evgi, and J. Leathery, “When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors,” Google Cloud Blog, Feb. 27, 2024. [Online]. Available: https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east