Kothamine RAT Abuses Tailscale's tailcat for SOC-Invisible C2

On September 25, Malwarebytes Threat Intelligence published its analysis of Kothamine, a previously undocumented remote access trojan that uses tailcat — an open-source tool derived from Tailscale — to establish encrypted C2 communications that evade conventional network detection. The discovery documents a significant tactical shift: operators have abandoned the classic Tailscale VPN in favor of a "serverless" architecture that requires no accounts, device registration, or static IP addresses, rendering the traditional blocklist-based approach to domains and IPs ineffective.

From Tailscale VPN to tailcat: The C2 Evolutionary Path

Earlier versions of Kothamine, detected on VirusTotal, directly employed Tailscale VPN with cleartext strings in the code. According to Malwarebytes, operators subsequently migrated to tailcat, designed by Tailscale's own developers for ephemeral connections without administrative governance. The official Tailscale documentation, cited in the analysis, describes tailcat as lacking "IP addresses, accounts, admins, users, administrative controls, or governance" — characteristics Malwarebytes explicitly judges attractive for malicious use.

The command documented in the sample is precise: tailcat.exe forward tc…. 18080:4444. Tailcat forwards local port 18080 on the compromised system to port 4444 on an operator-controlled node, creating an encrypted tunnel via WireGuard through Tailscale's DERP (NAT traversal) relays. The Kothamine agent then communicates with the local socket 127.0.0.1:18080, making traffic appear to originate from a legitimate process on the infected machine.

"The distinctive feature of Kothamine is not technical complexity, the agent functionality or obfuscation, but its use of tailcat and Tailscale VPN to receive commands to execute. That gives the agent a resilient, encrypted communication channel." — Malwarebytes Threat Intelligence

Infection and Persistence Mechanisms on Windows

Kothamine does not limit itself to an innovative C2 channel. Malwarebytes' technical analysis documents a DLL injection into explorer.exe via five documented Windows APIs: OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, and LoadLibraryA. The payload is extracted from the executable's resources, and tailcat is dropped to %ROAMING%\TailscalePortable ailcat.exe.

Persistence is ensured by a PowerShell script, up.ps1, which creates a scheduled task named 'MicrosoftEdgeUpdateTask' with a trigger at user logon. The same script adds Windows Defender exclusions to prevent payload removal. The agent profile sent to the C2 server includes machine name, operating system, IP 0.0.0.0 (masked), auth_token, and type 'base' — a minimal set that reduces the intelligence surface available to defenders.

Encryption and Command Protocol

C2 communications use AES-GCM with a 32-byte key. Malwarebytes published the specific key found in the sample: mrowPsW2P5kzFGCNWeKAd+kYpo8Yy5c2pzaOSRuzisU=, base64-decoded to 32 bytes. The malware's internal stages, named 'aes_encrypt' and 'c2_key', confirm direct implementation without additional cryptographic wrappers. The hardcoded key in the binary is an architectural choice that simplifies forensic analysis but still permits operations: traffic remains unreadable to anyone without the key, including network operators and traditional DPI inspection tools.

Why It Matters

The Malwarebytes dossier presents significant limitations that condition the operational reading. Operator identity is not attributable; infection scale is not quantified; the campaign's strategic objective — espionage, crimeware, or APT-group activity — remains unknown. No administration panel or builder for the malware has been observed, and the .NET assembly components mentioned in the instructions are not present in the analyzed samples. The brief does not document specific corrective measures or remediation steps provided by the source.

The paradigm shift that tailcat introduces in the C2 context is, however, relevant for strategic reading. Traditional threat-intelligence-based detection systems — IOCs such as domains, IPs, and certificates — lose effectiveness against an architecture that does not generate these artifacts. Tailscale's DERP relays retain metadata, but the source does not specify what data is actually logged or whether it is accessible to defenders outside the Tailscale infrastructure.

Frequently Asked Questions

Is tailcat a Tailscale vulnerability?

No. tailcat is a legitimate open-source tool designed for temporary connections without administrative overhead. The issue is tactical abuse, not a security flaw in the software.

Why are npm packages an effective vector?

Distribution via 'dotnet-runtime-base' and similar packages exploits implicit trust in dependency management ecosystems. Developers run automated installations that can download payloads from external GitHub repositories without additional integrity checks documented in the brief.

Is Kothamine detectable?

The source does not provide complete indicators of compromise or specific detection methodologies. The presence of tailcat.exe in %ROAMING%\TailscalePortable and the scheduled task 'MicrosoftEdgeUpdateTask' are documented artifacts, but the legitimate nature of the tool complicates distinguishing malicious from legitimate use without additional context.

The shift from commercial VPNs to decentralized open-source tools marks a maturation phase in C2 infrastructure design. Operators no longer seek just encryption, but architectures that reduce traceable control points. For defenders, the challenge shifts from blocking endpoints to monitoring process-network behavior, with all the false-positive costs that approach entails when the abused tool is legitimate and potentially present in real enterprise environments.

Information is based on the cited advisory and current as of publication.

Sources

• https://www.malwarebytes.com/blog/threat-intel/2026/09/kothamine-malware-uses-tailscales-tailcat-to-evade-network-detection

Information is based on the cited source and current as of publication.

Sources