Imperial Kitten Uses Credential-Gated Phishing and Resilient Azure C2
Summary
Picus details Imperial Kitten’s credential-gated phishing, DLL sideloading, obfuscated backdoors, credential theft and resilient Azure-hosted C2, alongside attack simulations for testing defenses.
Key points
- The article describes Imperial Kitten, also known as Tortoiseshell, as an IRGC-linked group targeting aerospace, defense and IT organizations across multiple regions.
- Phishing portals validate per-victim credentials before delivering malicious archives, limiting payload access to intended targets.
- The group uses DLL sideloading with legitimate software, including persistence through a Windows Run key, to launch backdoors and other tools.
- Reported malware defenses against analysis include LLVM-style obfuscation, runtime API resolution and separately encrypted strings.
- Credential theft methods include fake login pages and Windows dialogs, browser credential collection, and internal phishing; the article also describes screenshot collection.
- Backdoors use HTTPS and Azure-hosted infrastructure, often with multiple fallback C2 servers; the group also uses reverse SSH and custom tunneling tools.
- Picus lists 14 threat simulations for Imperial Kitten-related campaigns and malware across endpoint, network and email modules.
Article Details
- Attack Vectors
- Spearphishing emails and professional-social-media approaches use job offers, password-reset themes, and per-victim links to credential-harvesting portals.
- Fake login portals validate victim-specific credentials before serving malicious ZIP archives.
- Trojanized installers and trusted vendor executables side-load malicious DLLs.
- After gaining access, the group uses internal spearphishing, credential collection, browser-session access, and reverse SSH or custom tunnels.
- Defensive Notes
- The article recommends simulating Imperial Kitten attacks with the Picus Platform to validate security controls.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | neexportfolio[.]azurewebsites[.]net | Reported hardcoded C2 domain in a TWOSTROKE sample. |
| DOMAIN | neexportfolio[.]com | Reported hardcoded C2 domain in a TWOSTROKE sample. |
| DOMAIN | neexportfolio[.]eastus[.]cloudapp[.]azure[.]com | Reported hardcoded C2 domain in a TWOSTROKE sample. |
| DOMAIN | oneglobalvisa[.]com | Host receiving browser-stealer requests, including reports of victim username and domain and uploads of browser login data. |
| DOMAIN | teledyneflir[.]com[.]de | Lookalike lure portal used to harvest credentials; the article also says the infrastructure hosted backdoor archives. |
| DOMAIN | telespazio-careers[.]com | Career-themed phishing domain used to direct targets to a per-victim job-application link. |
| HOSTNAME | mydocs[.]qatarcentral[.]cloudapp[.]azure[.]com | Lookalike internal-phishing domain hosted on attacker infrastructure. |
MITRE ATT&CK
T1008 · Fallback ChannelsBackdoors embed multiple C2 servers and rotate to another when a server is unavailable.T1027 · Obfuscated Files or InformationBackdoors and the browser stealer use custom LLVM-style obfuscation, junk code, flattened branches, and separately XOR-encrypted strings.T1027.007 · Dynamic API ResolutionThe C++ backdoor decrypts DLL and API names at runtime, resolves APIs dynamically, and stores resolved addresses in a map.T1036.005 · Match Legitimate Resource Name or LocationMalicious DLLs use names such as wtsapi32.dll and VGAuth.dll to resemble legitimate system or VMware files.T1056.002 · GUI Input CaptureTRUSTTRAP displays a fake Windows Security dialog and saves entered credentials in cleartext.T1071.001 · Web ProtocolsTWOSTROKE and MiniJunk communicate with C2 servers over HTTPS using Windows networking APIs.T1102 · Web ServiceThe group hosts C2 infrastructure on Azure Web Apps and Cloud Apps and, in a later architecture, combines Cloudflare with Azure App Service.T1113 · Screen CaptureA C-based utility captures screenshots at regular intervals and saves numbered JPEG files in timestamped folders.T1534 · Internal SpearphishingAfter initial access, the group sends internal password-reset lures to IT staff and administrators using details copied from compromised inboxes.T1547.001 · Registry Run Keys / Startup FolderThe loader registers MigAutoPlay.exe in the current user's Run key so the host launches and side-loads userenv.dll at logon.T1555.003 · Credentials from Web BrowsersThe group obtains saved browser credentials from active sessions and uses a browser stealer to collect Edge login data.T1566.002 · Spearphishing LinkThe group sends recruitment-themed emails with lookalike careers links and uses follow-up messages containing job-application links and per-victim credentials.T1572 · Protocol TunnelingThe group uses reverse SSH tunnels and custom tunneling utilities; LIGHTRAIL communicates over WebSocket through Azure infrastructure.T1573.001 · Symmetric CryptographyThe article describes backdoor variants that apply XOR encryption to C2 communications and use a single-byte XOR key to decode embedded C2 hostnames.T1574.001 · DLLThe group places malicious DLLs beside legitimate executables, including Setup.exe and SenseSampleUploader.exe, to exploit DLL search order and side-loading.
Threat Actors
Crimson SandstormThe article lists Crimson Sandstorm as an alias of Imperial Kitten, which it reports conducting phishing, credential theft, and malware operations.Cuboid SandstormThe article lists Cuboid Sandstorm as an alias of Imperial Kitten, which it reports conducting phishing, credential theft, and malware operations.CURIUMThe article lists CURIUM as an alias of Imperial Kitten, which it reports conducting phishing, credential theft, and malware operations.DUSTYCAVEThe article lists DUSTYCAVE as an alias of Imperial Kitten, which it reports conducting phishing, credential theft, and malware operations.Imperial KittenThe article attributes phishing, credential theft, DLL side-loading, and C2 operations targeting aerospace, defense, and IT organizations to this group.Nimbus ManticoreThe article lists Nimbus Manticore as an alias of Imperial Kitten, which it reports conducting phishing, credential theft, and malware operations.TA456The article lists TA456 as an alias of Imperial Kitten, which it reports conducting phishing, credential theft, and malware operations.TortoiseshellThe article lists Tortoiseshell as an alias of Imperial Kitten, which it reports conducting phishing, credential theft, and malware operations.UNC1549The article lists UNC1549 as an alias of Imperial Kitten and describes operations involving phishing, credential theft, and malware targeting aerospace and defense organizations.Yellow LidercThe article lists Yellow Liderc as an alias of Imperial Kitten, which it reports conducting phishing, credential theft, and malware operations.
Malware
DEEPROOTDEEPROOT’s C2 responses use the delimiter -===- to separate fields for sleep timeout, command ID, the command itself, and up to two optional arguments [2].MinibikeIts MINIBIKE backdoor also carried string obfuscation and additional obfuscation layers.MinibusMinibus Backdoor Malware Download ThreatMiniJunkThe MiniJunk backdoor follows a similar pattern, using regular HTTPS requests through the Windows API to reach its controllers.TWOSTROKEThe TWOSTROKE backdoor establishes SSL-encrypted connections on TCP/443 using the Windows WinHttp API.
Vendors
CitrixIt abused legitimate Fortinet, VMware, Citrix, Microsoft, and NVIDIA executables, sometimes installing the software after initial access and sometimes planting DLLs into existing installation directories with SYSTEMCloudflareIn June 2025, the group re-architected its C2 infrastructure to combine Cloudflare and Azure App Service, improving operational resiliency.FortinetIt abused legitimate Fortinet, VMware, Citrix, Microsoft, and NVIDIA executables, sometimes installing the software after initial access and sometimes planting DLLs into existing installation directories with SYSTEMMicrosoftImperial Kitten hosts C2 servers on Microsoft Azure, blending malicious traffic with legitimate cloud activity to avoid detection.NvidiaIt abused legitimate Fortinet, VMware, Citrix, Microsoft, and NVIDIA executables, sometimes installing the software after initial access and sometimes planting DLLs into existing installation directories with SYSTEMVMwareThe group also planted tools inside legitimate VMware Tools folders.
Products
AzureImperial Kitten hosts C2 servers on Microsoft Azure, blending malicious traffic with legitimate cloud activity to avoid detection.Microsoft WindowsRegSetValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MigAutoPlayVMware ToolsThe group also planted tools inside legitimate VMware Tools folders.ZoomFebruary 2026 - Delivers malware through a Trojanized Zoom installer using valid digital certificates to evade detection, in what researchers name “Operation Epic Fury.”
Tools
GHOSTLINEGHOSTLINE, written in Golang, uses the go-yamux multiplexing library for its network connection and communicates over a hardcoded domain [2].LIGHTRAILThe group also deploys LIGHTRAIL, a custom tunneler likely based on the open-source Lastenzug Socks4a proxy.NgrokIn addition to backdoor-level redundancy, the group deployed alternative remote access tools such as ZEROTIER and NGROK.POLLBLENDPOLLBLEND, another custom C++ tunneler, registers the compromised machine with the C2 by sending a POST request to /register/ containing the computer name in a JSON body [2].TRUSTTRAPImperial Kitten uses TRUSTTRAP to collect credentials for lateral movement.ZEROTIERIn addition to backdoor-level redundancy, the group deployed alternative remote access tools such as ZEROTIER and NGROK.
Countries
AustraliaAugust 2026 - Continued operations expose activity spanning the UAE, Saudi Arabia, the UK, Canada, Australia, and Japan.CanadaAugust 2026 - Continued operations expose activity spanning the UAE, Saudi Arabia, the UK, Canada, Australia, and Japan.IndiaFebruary 2024 - Imperial Kitten operations across Israel, UAE, Turkey, and India are exposed, including credential harvesting through fake login pages impersonating major defense companies.IranImperial Kitten is an IRGC-linked Iranian APT targeting aerospace and defense sectors globally since 2017.IsraelJune 2022 - Begins targeting aerospace and defense organizations in Israel and the UAE through fake job offers.JapanAugust 2026 - Continued operations expose activity spanning the UAE, Saudi Arabia, the UK, Canada, Australia, and Japan.Saudi Arabia2017-2018 - Becomes active, compromising IT service providers in Saudi Arabia through supply chain attacks.TürkiyeFebruary 2024 - Imperial Kitten operations across Israel, UAE, Turkey, and India are exposed, including credential harvesting through fake login pages impersonating major defense companies.United Arab EmiratesJune 2022 - Begins targeting aerospace and defense organizations in Israel and the UAE through fake job offers.United KingdomAugust 2026 - Continued operations expose activity spanning the UAE, Saudi Arabia, the UK, Canada, Australia, and Japan.United States2020-2021 - Runs a years-long social media catfishing campaign targeting US military personnel and defense contractors through fake personas.