Kothamine RAT Leverages Tailscale’s tailcat to Hide C2 Traffic in npm Supply‑Chain Attacks
What Happened – Malwarebytes identified a new remote‑access Trojan, Kothamine Agent, that can execute over 30 commands on compromised Windows hosts, steal browser data, and record audio/video. Recent variants embed tailcat, an open‑source Tailscale utility, to tunnel encrypted C2 traffic, making network‑based detection difficult. The malware is distributed via malicious npm packages that appear legitimate to developers.
Why It Matters for Trust & Control Assurance
- Demonstrates how open‑source tooling can be repurposed to bypass traditional network controls, highlighting the need for continuous monitoring of third‑party code.
- Illustrates a supply‑chain risk where a compromised npm package provides a covert C2 channel, stressing the importance of robust vendor‑risk oversight and evidence‑based assurance of software components.
- Aligns with Verisq’s Vendor Risk Management capability: continuous verification of third‑party artifacts, automated SBOM analysis, and audit‑ready documentation of supply‑chain controls.
Who Is Affected – Software developers, DevOps teams, and any organization that incorporates npm packages into applications (technology/SaaS, cloud‑infra, and downstream customers).
Recommended Actions
- Inventory all npm dependencies and generate an up‑to‑date SBOM.
- Enforce strict provenance checks: verify package maintainers, review download counts, and scan new packages with malware detection tools before acceptance.
- Deploy network‑level TLS inspection or endpoint detection that can flag anomalous use of tools like tailcat.
- Integrate continuous third‑party risk monitoring into your control‑assurance program to maintain defensible audit evidence. Source: Malwarebytes Labs
Technical Notes – Kothamine is written in C/C++, delivered as an injector + DLL, and uses tailcat (or the Tailscale VPN) for encrypted C2. The malware has been observed in malicious npm packages such as dotnet-runtime‑base, with some builds also bundling a UAC bypass. Source: Malwarebytes Labs