Operation ShadowCat: Stealthy RAT Targets Indian Politics

Operation ShadowCat is a sophisticated phishing campaign that uses a deceptive .LNK file to run embedded PowerShell which loads a .NET loader that retrieves a steganographically concealed GZip payload from PNGs; the payload is injected into powershell.exe via APC and executes a Go-based RAT providing extensive remote control, exfiltration, Active Directory/credential tooling, and ransomware staging—multiple IOCs, a YARA rule, and MITRE ATT&CK mappings are provided.