APT35-Linked Documents Detail Two RATs, Custom Webshells and Malware Operations
Summary
CloudSek analyzes documents it attributes to APT35/Charming Kitten, detailing two Windows RATs, custom ASP webshells, operational tooling, targeting claims, and behavioral detection guidance.
Key points
- The analysis describes Saqeb, a modular native-code Windows RAT, and RAT-2AC2, a .NET RAT with command execution, keylogging, file transfer, screenshots, and browser-based VNC.
- Saqeb is described as using HTTP/HTTPS, XOR-encrypted traffic, and multi-hop infrastructure involving TOR.
- Custom ASP webshells reportedly execute commands through HTTP headers, including an Accept-Language-based covert command channel.
- The documents reportedly include phishing tools, malware training materials, testing procedures, and anti-detection features.
- CloudSek reports that the group’s documents claim access to more than 300 entities and describe activity spanning 2022–2025; these are claims presented in the analysis.
- The article provides behavioral detection patterns for the RATs and webshells, alongside MITRE ATT&CK mappings.
Article Details
- Attack Vectors
- Google Drive phishing kits delivered .rar attachments.
- The m0s.asp, file.asp, and webshell.asp variants execute commands through HTTP request headers on web servers.
- RAT-2AC2 uses service-like names and HTTP API communication; Saqeb uses HTTP/HTTPS C2, with multi-hop relays and TOR described in the article.
- Defensive Notes
- For suspected Saqeb activity, the article recommends isolating the system, collecting a memory dump, and alerting the SOC.
- For suspected RAT-2AC2 activity, the article recommends terminating the process, blocking C2 IPs, and conducting a forensic investigation.
- For suspected webshell activity, the article recommends blocking the source IP, terminating the web process, and checking for persistent webshells.
- The article describes behavioral detections involving unusual Accept-Language headers, IIS worker processes spawning command interpreters, RAT polling and system enumeration, and Saqeb loading DLLs from .dat files.
MITRE ATT&CK
T1001.002 · SteganographyThe m0s.asp variants use an encoded command channel in the Accept-Language header.T1005 · Data from Local SystemSaqeb and RAT-2AC2 can download files and extract Firefox or Telegram data from local systems.T1016 · System Network Configuration DiscoveryThe webshells and RATs are described as performing network enumeration, including ipconfig execution.T1020 · Automated ExfiltrationSaqeb reportedly schedules data collection and transmission.T1021.006 · Windows Remote ManagementThe article cites WMIC commands in webshell scripts as evidence of Windows Remote Management activity.T1027.002 · Software PackingSaqeb modules are reportedly hex-encoded.T1027.007 · Dynamic API ResolutionSaqeb reportedly resolves APIs at runtime using LoadLibrary and GetProcAddress.T1030 · Data Transfer Size LimitsSaqeb reportedly transfers files in chunks.T1033 · System Owner/User DiscoveryThe article describes username collection and whoami command execution.T1036.004 · Masquerade Task or ServiceRAT-2AC2 reportedly uses legitimate service-like names, including Microsoft, Exchange, and Windows names.T1036.008 · Masquerade File TypeSaqeb reportedly uses .dat extensions for DLL modules.T1041 · Exfiltration Over C2 ChannelThe article describes malware exfiltrating data through HTTP POST and C2 communications.T1049 · System Network Connections DiscoveryThe webshell behavioral guidance identifies netstat command execution.T1056.001 · KeyloggingSaqeb's klg.dll is described as capturing keystrokes through a keyboard hook.T1057 · Process DiscoveryThe article attributes process enumeration capabilities to the RATs.T1059.001 · PowerShellThe webshells and RAT-2AC2 are described as executing commands, including through PowerShell.T1059.003 · Windows Command Shellm0s.asp and related webshells execute commands using cmd /c through WScript.Shell.T1070.004 · File DeletionSaqeb includes a self-destruct function that removes the RAT.T1071.001 · Web ProtocolsThe article describes HTTP/HTTPS C2 communication for the malware.T1080 · Taint Shared ContentThe article describes webshell-related file uploads to UNC shares.T1082 · System Information DiscoveryRAT-2AC2 runs systeminfo, and the webshells can execute system information commands.T1083 · File and Directory DiscoverySaqeb reportedly enumerates files at disk level.T1090.003 · Multi-hop ProxySaqeb reportedly uses relay servers and a multi-hop TOR route.T1095 · Non-Application Layer ProtocolThe article describes Saqeb using TOR and .onion addresses for communications.T1105 · Ingress Tool TransferSaqeb reportedly downloads modules from C2.T1106 · Native APISaqeb is described as using native APIs including CreateEventA and LoadLibrary.T1112 · Modify RegistryThe article reports that Saqeb uses registry manipulation for persistence.T1113 · Screen CaptureBoth RATs reportedly support desktop screenshot capture.T1119 · Automated CollectionSaqeb reportedly automates file enumeration and collection.T1132.001 · Standard EncodingThe article describes Base64, hex, and other encoding of data handled by the malware.T1140 · Deobfuscate/Decode Files or InformationThe article describes runtime hex decoding, XOR decryption, and string deobfuscation in the malware and webshells.T1190 · Exploit Public-Facing ApplicationThe article describes m0s.asp webshell deployment on web servers.T1204.002 · Malicious FileThe article describes phishing attachments and malware executables as user-executed files.T1486 · Data Encrypted for ImpactThe article reports a Saqeb-ransom variant with a ransomware encryption routine.T1497 · Virtualization/Sandbox EvasionThe article describes anti-VM techniques in malware training materials.T1505.003 · Web ShellThe article describes m0s.asp, file.asp, and webshell.asp variants deployed as webshells.T1518.001 · Security Software DiscoveryThe article says Saqeb and RAT-2AC2 detect security software, naming Kaspersky and BitDefender.T1543.003 · Windows ServiceRAT-2AC2 reportedly masquerades as a service; the article also claims elevated service creation.T1547.001 · Registry Run Keys / Startup FolderSaqeb supports configurable daily or weekly auto-run scheduling.T1552.001 · Credentials In FilesSaqeb reportedly steals Telegram session files.T1555.003 · Credentials from Web BrowsersSaqeb reportedly extracts Firefox credentials using nss3.dll.T1562.001 · Disable or Modify ToolsThe article says the rns.dll file-destruction module uses antivirus exclusion paths.T1566.001 · Spearphishing AttachmentGoogle Drive phishing kits reportedly used .rar attachments.T1571 · Non-Standard PortThe article reports webshell use on port 9003 and other custom ports.T1573.001 · Symmetric CryptographySaqeb reportedly uses XOR-based traffic encryption.T1622 · Debugger EvasionAnti-debug mechanisms are documented in the Saqeb manual.
Threat Actors
Malware
file.aspB. file.asp / webshell.asp - Simpler Variantsm0s.aspWebshells: Custom m0s.asp variants using Accept-Language header covert channel and substitution cipherRAT-2AC2Kitten's complete malware development pipeline, including two distinct RAT families (Saqeb System and RAT-2AC2), custom webshells, training materials, and operational testing procedures. This collection represents aSaqeb SystemAPT35/Charming Kitten's complete malware development pipeline, including two distinct RAT families (Saqeb System and RAT-2AC2), custom webshells, training materials, and operational testing procedures. ThisSaqeb-ransomSaqeb-ransom variantwebshell.aspB. file.asp / webshell.asp - Simpler Variants
Products
.NET FrameworkDevelopment: C# language + .NET Framework 4FlaskRAT-2AC2: .NET-based RAT with Flask backend, VNC capability, masquerading as legitimate servicesIISAim: Full RCE with IIS worker process privileges, no authentication, direct header-to-shell execution.Microsoft Windowsassurance, anti-detection research, and modular architecture designed for long-term persistence in Windows environments.Mozilla FirefoxFirefox/Telegram extractionnoVNCTriggers bore/noVNC setupTelegramFirefox/Telegram extractionVisual StudioCompilation: Visual Studio 2015
Tools
Countries
Egypt6+ countries targeted (UAE, Jordan, Turkey, Israel, Egypt, Saudi Arabia)Israel6+ countries targeted (UAE, Jordan, Turkey, Israel, Egypt, Saudi Arabia)Jordan6+ countries targeted (UAE, Jordan, Turkey, Israel, Egypt, Saudi Arabia)Saudi Arabia6+ countries targeted (UAE, Jordan, Turkey, Israel, Egypt, Saudi Arabia)Turkey6+ countries targeted (UAE, Jordan, Turkey, Israel, Egypt, Saudi Arabia)UAE6+ countries targeted (UAE, Jordan, Turkey, Israel, Egypt, Saudi Arabia)
Industries
AviationAviation: FlyDubaicommunicationsCommunications: EpostaLaw enforcementRegional intelligence: Airport/hotel databases, law enforcement, SCADA systemsOil & GasOil & gas facilities (UAE, Saudi Arabia)Power generation/distributionPower generation/distributionTourismMultiple confirmed breaches: FlyDubai, Dubai Police, Jordan Desert Tourism, Eposta, plus all Episode 1-2 victimsWater treatmentWater treatment plants (mentioned: National Water Company access in Episode 2)