Threat actors with suspected ties to Iran have been found to leverage instant messaging and VPN apps like Telegram and Psiphon to install a Windows remote access trojan (RAT) capable of stealing sensitive information from targets' devices since at least 2015.

Russian cybersecurity firm Kaspersky, which pieced together the activity, attributed the campaign to an advanced persistent threat (APT) group it tracks as Ferocious Kitten, a group that has singled out Persian-speaking individuals allegedly based in the country while successfully operating under the radar.

"The targeting of Psiphon and Telegram, both of which are quite popular services in Iran, underlines the fact that the payloads were developed with the purpose of targeting Iranian users in mind," Kaspersky's Global Research and Analysis Team (GReAT) said.

"Moreover, the decoy content displayed by the malicious files often made use of political themes and involved images or videos of resistance bases or strikes against the Iranian regime, suggesting the attack is aimed at potential supporters of such movements within the country."

Kaspersky's findings emerge from two weaponized documents that were uploaded to VirusTotal in July 2020 and March 2021 that come embedded with macros, which, when enabled, drop next-stage payloads to deploy a new implant called MarkiRat.

The backdoor allows adversaries broad access to a victim's personal data, comprising features to record keystrokes, capture clipboard content, download and upload files, as well as the ability to execute arbitrary commands on the victim machine.

In what appears to be an attempt to expand their arsenal, the attackers also experimented with different variants of MarkiRat that were found to intercept the execution of apps like Google Chrome and Telegram to launch the malware and keep it persistently anchored to the computer at the same time also making it much harder to be detected or removed. One of the discovered artifacts also includes a backdoored version of Psiphon; an open-source VPN tool often used to evade internet censorship.

Another recent variant involves a plain downloader that retrieves an executable from a hardcoded domain, with the researchers noting that the "use of this sample diverges from those used by the group in the past, where the payload was dropped by the malware itself, suggesting that the group might be in the process of changing some of its TTPs."

What's more, the command-and-control infrastructure is also said to have hosted Android applications in the form of DEX and APK files, raising the possibility that the threat actor is also simultaneously developing malware aimed at mobile users.

Interestingly, the tactics adopted by the adversary overlap with other groups that operate against similar targets, such as Domestic Kitten and Rampant Kitten, with Kaspersky finding parallels in the way the actor used the same set of C2 servers over extended periods of time and attempted to gather information from KeePass password manager.

"Ferocious Kitten is an example of an actor that operates in a wider ecosystem intended to track individuals in Iran," the researchers concluded. "Such threat groups do not appear to be covered that often and can therefore get away with casually reusing infrastructure and toolsets without worrying about them being taken down or flagged by security solutions."