Kothamine Malware Evades Detection by Using Tailscale's tailcat for C2
A new remote-access Trojan, Kothamine Agent, has been discovered using Tailscale's tailcat tool for encrypted command-and-control, making it difficult to detect and block.
A newly identified remote-access Trojan (RAT) named Kothamine Agent is posing a significant threat to Windows users, offering attackers extensive control over infected systems. This malware, written in C and C++, supports over 30 commands, enabling adversaries to execute arbitrary commands, manipulate files, and extend the malware's capabilities by loading additional modules. Some variants are also equipped to steal sensitive browser data and capture audio and video through the system's microphone and camera.
Kothamine's recent evolution includes a sophisticated evasion technique: it now leverages tailcat, an open-source tool from Tailscale, to establish encrypted command-and-control (C2) communications. This method bypasses traditional detection mechanisms that rely on identifying specific C2 domains or IP addresses, as the encrypted traffic is routed through Tailscale's infrastructure. Earlier versions of Kothamine were observed using the Tailscale VPN directly for C2, indicating a progression in the malware's stealth capabilities.
The malware's distribution vector has been linked to malicious npm packages, potentially exposing software developers and users who install these compromised packages. Researchers found that one such package, npm-sc-legit.exe, downloaded a compiled version of Kothamine that also included data-stealing functionalities. The authors behind these campaigns inadvertently revealed their methods by including compilation instructions for Kothamine within one of the packages.
Technical analysis reveals that Kothamine typically operates with an injector component and a DLL containing the agent. The injector, often disguised as MicrosoftEdgeUpdateCore.exe, copies itself to a user's roaming profile, injects the agent DLL into legitimate processes like explorer.exe, and establishes persistence through scheduled tasks. It also attempts to add exclusions to Windows Defender to avoid antivirus detection.
Once injected, the Kothamine Agent DLL creates a mutex to ensure only one instance runs and then proceeds to add further Windows Defender exclusions. Unlike older versions where strings were unencrypted, recent variants employ inline decryption or XOR-based functions with unique keys for each string, further complicating static analysis. The use of tailcat for C2 communication means that commands are sent over an encrypted channel, making network-based detection extremely challenging.
Security researchers advise users to exercise extreme caution when installing npm packages, especially those from unknown or less reputable sources. Key recommendations include thoroughly checking the package's repository, maintainers, dependencies, and recent activity. Verifying the package name for typos, confirming the legitimacy of the publisher, and searching for any reported malicious activity are crucial steps. The popularity and download count of a package can also serve as an indicator of its trustworthiness.
While Kothamine's core functionality is that of a RAT, its modular design and evolving C2 methods highlight the increasing sophistication of malware. The reliance on tools like Tailscale's tailcat demonstrates threat actors' continuous efforts to blend malicious traffic with legitimate network communications, posing a persistent challenge for cybersecurity defenses.
The discovery of Kothamine, particularly its connection to malicious npm packages and its advanced evasion techniques, underscores the ongoing need for vigilance in the software development supply chain and robust endpoint security solutions capable of detecting anomalous behavior rather than relying solely on known signatures.