Iran APT SpearSpecter Uses Weeks-Long WhatsApp Lures and Fileless TAMECAT Backdoor to Hit Defense

According to the Israel National Digital Agency (INDA), researchers have disclosed a sophisticated, ongoing operation named SpearSpecter that is linked to Iranian state-aligned threat actors working for the IRGC-IO and uses weeks-long WhatsApp social engineering alongside a fileless TAMECAT PowerShell backdoor to hit high-value defence targets.

The campaign relies on slow, personalised engagement, with operators impersonating scholars or senior officials and messaging targets for days or weeks before introducing malicious elements, often via links disguised as conference materials hosted on OneDrive.

Once the trust is established, victims are directed to a WebDAV share that delivers a malicious LNK file, which in turn triggers a batch script download from Cloudflare Workers and begins the infection chain, with TAMECAT deployed afterwards for data exfiltration and remote control.

Key capabilities include in-memory execution, dynamic module loading via Cloudflare Workers, multi-channel C2 through HTTPS, Discord and Telegram, credential harvesting, AES-encrypted data exfiltration, and targeted file crawling, with Runs.dll enabling chunked uploads. The operators are described as aligned with IRGC-IO groups such as APT42, Mint Sandstorm, Educated Manticore, and CharmingCypress, targeting senior defence and government officials.