MalKamak APT’s ShellClient RAT: Inside Operation GhostShell

MalKamak (Operation GhostShell) is a targeted espionage group active since at least 2018 that deployed a modular ShellClient RAT against aerospace and telecommunications firms (primarily in the Middle East). The RAT uses AES-encrypted payloads, Dropbox-based C2 (Commands/Agents/Results folders), Windows service persistence (nhdService via InstallUtil.exe), credential dumping (lsa.exe producing debug.bin), process masquerading, and various remote administration tools (PAExec, csvde.exe) to collect and exfiltrate sensitive data.