LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0652: MarkiRAT

MarkiRAT is a remote access Trojan (RAT) compiled with Visual Studio that has been used by Ferocious Kitten since at least 2015.[1]

EnterpriseS0652MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

MarkiRAT matters because ATT&CK describes it as a Windows remote access Trojan associated with long-running surveillance activity. The relationship set maps it to behaviors that can turn one compromised workstation into a collection point: user and system discovery, command shell execution, persistence through Windows startup mechanisms, data staging, credential collection, screen/clipboard/key capture, web-based command and control, and exfiltration over that channel.

Executive priority

Treat this as a Windows endpoint resilience and sensitive-data exposure problem, not just a malware name. Leaders should ask whether high-risk users and systems have endpoint visibility, whether persistence mechanisms such as Run keys, startup folders, shortcuts, and BITS jobs are monitored, and whether SOC/IR teams can prove collection and exfiltration activity from a workstation. The Ferocious Kitten relationship and cited reporting provide threat-intelligence context, but local prioritization should be driven by business exposure, user risk, and data sensitivity.

Technical view

ATT&CK lists MarkiRAT on Windows and provides no official detection text, so validation should be behavior-led using the mapped techniques. SOC teams should test visibility for Windows command shell execution, native API-driven activity, process/user/system/software/security-tool discovery, local file and directory enumeration, local data staging, password-manager access, clipboard/screen/keylogging-related activity, BITS job abuse, Registry Run key/startup folder and shortcut persistence, inbound tool transfer, web-protocol C2, and exfiltration over the same C2 channel. Relationship context says Ferocious Kitten uses MarkiRAT; use that for enrichment, not as a standalone detection condition.

Likely telemetry

  • Windows EDR process creation, parent/child process, command-line, and module/API activity
  • Registry modification telemetry for Run keys and startup-related persistence
  • File system telemetry for startup folder and shortcut creation or modification
  • BITS job creation, modification, and transfer history
  • Windows command shell execution events

Detection direction

  • Build detections around technique chains rather than the malware name: discovery followed by staging, persistence, C2, and exfiltration is more actionable than any single weak signal.
  • Correlate Windows persistence changes with nearby command shell execution, BITS activity, tool transfer, or unusual outbound web traffic.
  • Tune discovery detections carefully because user, process, file, software, and security-tool enumeration can overlap with administration and inventory tools; prioritize unusual parent processes, user context, timing, and destination context.
  • For web-protocol C2, validate whether proxy/DNS/firewall logs preserve endpoint, user, process, URL/domain, timing, and volume context; encrypted traffic may limit content inspection.
  • For collection behaviors such as screen capture, clipboard access, keylogging, and password-manager access, confirm whether endpoint controls actually expose these events; many environments have blind spots here.

Mitigation priorities

  • Prioritize hardened Windows endpoint controls for high-risk users and systems, including prevention and monitoring of unauthorized persistence through Run keys, startup folders, shortcuts, and BITS jobs.
  • Limit the ability of untrusted processes to run command shells, transfer tools, or interact with sensitive local data where business operations allow.
  • Protect credential stores and password managers with strong access controls, user training, and monitoring for suspicious access patterns; assume credential exposure may require response actions if confirmed.
  • Ensure egress controls, proxy logging, and DNS/firewall monitoring can support investigation of web-protocol C2 and exfiltration over the same channel.
  • Maintain incident response playbooks that cover workstation triage, persistence removal, credential reset decisions, data-exposure assessment, and threat-intelligence enrichment.
Additional notes and limits

The ATT&CK object identifies MarkiRAT as a Visual Studio-compiled RAT used by Ferocious Kitten since at least 2015, with Kaspersky reporting as the cited source. The strongest defensive value comes from the mapped behaviors: discovery, collection, credential access, persistence, command and control, ingress transfer, and exfiltration. The malware object itself has no official detection guidance.

This take is limited to the supplied ATT&CK fields, external references, and relationships. ATT&CK lists the malware platform as Windows, while several related technique descriptions include broader platform coverage; do not infer non-Windows MarkiRAT deployment from this object alone. No indicators, hashes, infrastructure, prevalence, active exploitation status, or guaranteed detection logic were supplied.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

MarkiRAT

MarkiRAT is a remote access Trojan (RAT) compiled with Visual Studio that has been used by Ferocious Kitten since at least 2015.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

22 rows
DomainIDNameRelationship / procedure
EnterpriseT1197BITS Jobs

MarkiRAT can use BITS Utility to connect with the C2 server.[1]

EnterpriseT1614.001System Language DiscoverySub-technique

MarkiRAT can use the GetKeyboardLayout API to check if a compromised host's keyboard is set to Persian.[1]

EnterpriseT1033System Owner/User Discovery

MarkiRAT can retrieve the victim’s username.[1]

EnterpriseT1083File and Directory Discovery

MarkiRAT can look for files carrying specific extensions such as: .rtf, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pps, .ppsx, .txt, .gpg, .pkr, .kdbx, .key, and .jpb.[1]

EnterpriseT1106Native API

MarkiRAT can run the ShellExecuteW API via the Windows Command Shell.[1]

EnterpriseT1105Ingress Tool Transfer

MarkiRAT can download additional files and tools from its C2 server, including through the use of BITSAdmin.[1]

EnterpriseT1547.009Shortcut ModificationSub-technique

MarkiRAT can modify the shortcut that launches Telegram by replacing its path with the malicious payload to launch with the legitimate executable.[1]

EnterpriseT1005Data from Local System

MarkiRAT can upload data from the victim's machine to the C2 server.[1]

EnterpriseT1056.001KeyloggingSub-technique

MarkiRAT can capture all keystrokes on a compromised host.[1]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

MarkiRAT can drop its payload into the Startup directory to ensure it automatically runs when the compromised system is started.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

MarkiRAT can utilize cmd.exe to execute commands in a victim's environment.[1]

EnterpriseT1518.001Security Software DiscoverySub-technique

MarkiRAT can check for running processes on the victim’s machine to look for Kaspersky and Bitdefender antivirus products.[1]

EnterpriseT1082System Information Discovery

MarkiRAT can obtain the computer name from a compromised host.[1]

EnterpriseT1041Exfiltration Over C2 Channel

MarkiRAT can exfiltrate locally stored data via its C2.[1]

EnterpriseT1555.005Password ManagersSub-technique

MarkiRAT can gather information from the Keepass password manager.[1]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

MarkiRAT can masquerade as update.exe and svehost.exe; it has also mimicked legitimate Telegram and Chrome files.[1]

EnterpriseT1057Process Discovery

MarkiRAT can search for different processes on a system.[1]

EnterpriseT1074.001Local Data StagingSub-technique

MarkiRAT can store collected data locally in a created .nfo file.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

MarkiRAT can initiate communication over HTTP/HTTPS for its C2 server.[1]

EnterpriseT1518Software Discovery

MarkiRAT can check for the Telegram installation directory by enumerating the files on disk.[1]

EnterpriseT1115Clipboard Data

MarkiRAT can capture clipboard content.[1]

EnterpriseT1113Screen Capture

MarkiRAT can capture screenshots that are initially saved as ‘scr.jpg’.[1]

Associated objects

Groups, software, and campaigns

Relationship explorer

All related ATT&CK context

uses · TechniqueT1197: BITS JobsEnterpriseuses · TechniqueT1614.001: System Language DiscoveryEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · GroupG0137: Ferocious KittenEnterpriseuses · TechniqueT1547.009: Shortcut ModificationEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1555.005: Password ManagersEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1074.001: Local Data StagingEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1518: Software DiscoveryEnterpriseuses · TechniqueT1115: Clipboard DataEnterpriseuses · TechniqueT1113: Screen CaptureEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
1725dd36065bcf7e...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle1725dd36065b…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  2. [2]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  3. [3]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  4. [4]
    mitre-attackS0652
    Open source URL
  5. [5]
    mitre-attackS0652
    Open source URL
  6. [6]
    mitre-attackS0652
    Open source URL
  7. [7]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  8. [8]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  9. [9]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  10. [10]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  11. [11]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  12. [12]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  13. [13]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  14. [14]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  15. [15]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  16. [16]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  17. [17]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  18. [18]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  19. [19]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  20. [20]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  21. [21]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  22. [22]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  23. [23]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  24. [24]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  25. [25]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  26. [26]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  27. [27]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  28. [28]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  29. [29]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  30. [30]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  31. [31]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  32. [32]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  33. [33]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  34. [34]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  35. [35]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  36. [36]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  37. [37]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  38. [38]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  39. [39]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  40. [40]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  41. [41]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  42. [42]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  43. [43]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  44. [44]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  45. [45]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  46. [46]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  47. [47]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  48. [48]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  49. [49]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
  50. [50]
    Kaspersky Ferocious Kitten Jun 2021

    GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use