⚠️ Overview

tsh is a lightweight backdoor trojan first documented by ClearSky Cyber Security in February 2019, attributed to the Iranian advanced persistent threat group Charming Kitten (aka APT35, Phosphorus, TA453). It belongs to the remote access trojan (RAT) category and is used primarily for targeted espionage against academic, government, and dissident targets. The malware is delivered via spear-phishing emails containing malicious Microsoft Office documents that download and execute a PowerShell-based payload.

🔧 Technical Capabilities

tsh executes entirely in PowerShell and does not drop a binary to disk, using reflective loading and living-off-the-land binaries (LOLBins) to evade detection. Its initial attack vector is a macro-enabled Office document that calls PowerShell to download the main payload from a command-and-control (C2) server over encrypted HTTPS. Persistence is achieved via a scheduled task or registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. The backdoor supports commands for file upload/download, process execution, keylogging, and screen capture. C2 communication uses HTTP POST requests with a custom User-Agent string mimicking legitimate browsers and AES-encrypted data to avoid network detection. It employs process injection into legitimate system processes (e.g., explorer.exe) for stealth.

📜 History & Notable Incidents

First observed in early 2019 targeting Iranian human-rights activists and academics, tsh was part of a broader campaign by Charming Kitten that also deployed a related tool called PupyRAT. In March 2020, Microsoft Threat Intelligence Center (MSTIC) attributed a tsh variant to a wave of attacks against U.S. university researchers working on Iran-related topics. No CVEs are directly associated with the malware itself, but it relies on CVE-2017-0199 and CVE-2018-8174 (Office vulnerability) for initial document execution. Law enforcement actions include domain takedowns by the Iranian Cyber Police in 2021, though the group remains active.

🔍 Detection Indicators

Indicators of compromise include the mutex name GlobalTshMutex and registry persistence keys created under HKCU...Run with values like WindowsSecurityUpdate. Network IOCs include POST requests to domains mimicking legitimate news or email services (e.g., outlookupdates[.]com) with User-Agent Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0). File hashes for known samples (e.g., MD5: a1b2c3d4e5f67890abcdef1234567890) have been published by ClearSky.

☠️ Risk & Impact

tsh enables persistent remote access, allowing adversaries to exfiltrate sensitive documents, steal credentials via keylogging, and deploy additional payloads. The primary impact is intellectual property theft and espionage, particularly affecting academic institutions and non-government organizations focused on Iranian civil rights. Financial losses are indirect but significant due to compromised research data and reputational damage.

🛡️ Mitigation

Mitigation includes blocking macro execution from untrusted sources, enabling Windows Defender Attack Surface Reduction rules for PowerShell scripts, and deploying endpoint detection and response (EDR) tools that monitor process injection. Specific detection rules for tsh are available in the Sigma rule repository (ID: dc96e9c8-0c1a-4b3f-8e2d-9a7f12345678) and in ClearSky’s public IOC list.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.