Ferocious_Kitten__2021__Ferocious_Kitten_6_years_of_covert_surveillance_in_Iran_Securelist.pdf

Ferocious Kitten is a persistent APT campaign active since at least 2015 that targets Persian-speaking users in Iran using the MarkiRAT implant and related tooling; the actor employs weaponized documents, binaries that hijack Telegram and Chrome for persistence, keylogging and clipboard theft, file exfiltration, and downloader components, with multi-platform indications and multiple C2 domains and IOCs provided.