Security1 publisher2 min readPublished
Kothamine RAT tunnels its commands through Tailscale's tailcat
Malwarebytes found Kothamine, an undocumented Windows RAT hidden in malicious npm packages, that takes its 30-plus commands over Tailscale's tailcat. The encrypted channel leaves no command-and-control domain to block, pushing detection onto the endpoint.
The Watch · Security desk
What happened
- Malwarebytes discovered Kothamine Agent, an undocumented Windows remote-access trojan that supports more than 30 commands and hands an operator control of the infected machine.
- Recent builds pull their commands through tailcat, Tailscale's open-source tool, over an encrypted connection that resists network inspection.
- VirusTotal uploads and GitHub commits place Kothamine in development or distribution since at least July.
- Some builds add browser-data theft, camera and microphone recording, and a User Account Control bypass not present in every version.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint There is no attacker domain in the traffic to block, so DNS and IP reputation stop helping and detection falls to spotting Tailscale or tailcat running on a host that never deployed them.
- exposure The entry point is npm, so a single poisoned dependency can put a developer workstation or a build agent under an operator's full control.
- capability With no fixed feature set and no builder found, two machines hit by the same malware can behave differently, and an early triage may miss a stealer or camera capture that a later command enables.
On disk the malware arrives in two parts. Most of the samples Malwarebytes analyzed are an injector paired with a DLL that carries the agent, both written in C and C++ [10]. The injector adds Windows Defender exclusions through PowerShell, copies itself to %ROAMING%\MicrosoftEdgeUpdateCore.exe, drops the agent DLL beside it, writes an up.ps1 script to %TEMP%, and injects the DLL into explorer.exe [18]. The up.ps1 script registers a scheduled task named MicrosoftEdgeUpdateTask that runs the injector at every logon [19].
Once inside explorer.exe the agent can pull down additional DLLs to add functions on demand [11]. Malwarebytes found no control panel or builder for it, which fits operators enabling particular functions and commands as needed [17].
The tool has changed over its life. The earliest versions Malwarebytes found on VirusTotal used the full Tailscale VPN instead of tailcat, and their strings were not encrypted [8]. Depending on the build, the networking tools are compiled into the agent or fetched at runtime from GitHub or Tailscale's own website [9].
The delivery is npm. A GitHub repository tied to Kothamine is named in an advisory about a package called dotnet-runtime-base, which downloads npm-sc-legit.exe from that repo [13]. That executable is a compiled Kothamine with data-stealing commands built in [16]. Two more packages from the same developer had been removed by the time Malwarebytes published [14]. The authors also left their own compile instructions for kothamine-stub-cpp inside one package, and the guide covers loading .NET assemblies that Malwarebytes did not see in the samples it analyzed [15].
Malwarebytes' guidance is package hygiene at install time: check a package's repository, maintainers, dependencies, and recent releases before installing, and favor packages with an established history [20].
What to watch
- Whether npm and GitHub pull the remaining package and repository, and whether the developer republishes under new names.
- Whether a control panel or builder for Kothamine surfaces, which would show it is shared or sold rather than run by one crew.
- Whether later builds drop bundled binaries entirely for runtime fetches, shrinking the on-disk footprint further.