TAMECAT Exposed: APT42’s Fileless Backdoor Targets Defense Chiefs

A Pulsedive and Israel National Digital Agency analysis links APT42 to a targeted espionage campaign using TAMECAT, a modular in-memory PowerShell backdoor that steals browser data, captures screens, and crawls files; the infection chain employs VBScript loaders and heavy obfuscation with a hardcoded AES-256 key, and operators use prolonged social engineering (e.g., WhatsApp) to gain access while blending C2 traffic through Cloudflare Workers, Telegram, Discord, and WebDAV.