Ferocious Kitten APT Uses MarkiRAT for Keystroke and Clipboard Surveillance

Ferocious Kitten, a covert cyber-espionage group active since at least 2015, uses its MarkiRAT implant to conduct keystroke and clipboard logging, screenshot capture, credential theft, and broader surveillance while evading defences. The group commonly begins campaigns with spearphishing emails carrying malicious Microsoft Office files embedded with macros or MSHTML exploits, dropping MarkiRAT onto victims’ systems when opened.

Milestones include the 2015-onward delivery of decoy documents with embedded macros, a June 2021 disclosure by Kaspersky detailing the spyware and political context, and a November 2021 exploitation of the MSHTML RCE vulnerability (CVE-2021-40444) to deploy a PowerShell-based stealer. MarkiRAT’s persistence mechanisms include placing itself in startup paths, masquerading as legitimate apps, and using a RTLO unicode trick to disguise .exe files as harmless media.

It also leverages the Windows BITS tool for stealthy C2 communication and reconnaissance, and it can target security software such as Kaspersky and Bitdefender before exfiltrating data. According to Picus Security Validation Platform, organisations should validate controls to detect and prevent Ferocious Kitten’s activity. 11 November 2025