From 5294558753348244107c158fc53c0c871e923bd2 Mon Sep 17 00:00:00 2001
From: S3N4T0R <121706460+S3N4T0R-0X0@users.noreply.github.com>
Date: Mon, 16 Feb 2026 06:11:49 -0500
Subject: [PATCH] Enhance README with Static Kitten attack details
Expanded the README with detailed attack simulation steps and techniques used by the Static Kitten APT group, including delivery methods and payload characteristics.
---
Iranian APT/Static Kitten/README.md | 19 ++++++++++++++-----
1 file changed, 14 insertions(+), 5 deletions(-)
diff --git a/Iranian APT/Static Kitten/README.md b/Iranian APT/Static Kitten/README.md
index 928c88e..d8b7b27 100644
--- a/Iranian APT/Static Kitten/README.md
+++ b/Iranian APT/Static Kitten/README.md
@@ -4,11 +4,6 @@ This is a simulation of attack by (Static Kitten) APT group targeting multiple s
-The attack kicks off with a spear-phishing email sent from the compromised info@tmcell address — a legitimate domain tied to TMCell (Altyn Asyr CJSC), Turkmenistan's main mobile telecom provider. The subject line reads "Cybersecurity Guidelines", making it look like an official advisory from a trusted source.
-
-The email carries an attachment named Cybersecurity.doc, which acts as the initial payload. When the recipient opens the document and enables macros (as prompted), an obfuscated VBA macro runs. This macro extracts a hex-encoded blob hidden in the document's structure (often within UserForm elements), cleans it up by stripping spaces and line breaks, converts it to binary, and drops it as CertificationKit.ini in the ProgramData folder.
-
-That dropped file is actually an installer that launches the final stage: a Rust-compiled executable (masquerading as reddit.exe with a Cloudflare icon). Known as RustyWater (also linked to Archer RAT / RUSTRIC), this implant handles persistence via registry Run keys, injects into processes for evasion, and sets up asynchronous command-and-control over HTTP using JSON payloads. The C2 traffic features Base64 encoding combined with XOR obfuscation to stay under the radar from AV and EDR tools.
Throughout, the macro itself is heavily obfuscated to dodge static detection, and the overall chain emphasizes low-noise execution with strong anti-analysis tricks built into the Rust binary. This progression — phishing email → malicious doc → obfuscated macro dropper → RustyWater implant — shows Static Kitten's shift toward more resilient, modular tooling in recent campaigns targeting Middle East sectors.
@@ -21,3 +16,17 @@ Throughout, the macro itself is heavily obfuscated to dodge static detection, an
3. The payload and evasion: The final payload dropped by the obfuscated VBA macro loader is a Rust-compiled executable (disguised as reddit.exe with a fake Cloudflare icon), known as RustyWater (or linked to Archer RAT/RUSTRIC), featuring strong AV/EDR evasion through process injection, registry based persistence.
4. C2 infrastructure: relies on HTTP protocol for all communications, leveraging the Rust reqwest library with configurable timeouts, connection pooling, and retry mechanisms for reliability. Data payloads are structured as JSON, then encoded in Base64, followed by a final XOR encryption layer to obfuscate traffic and complicate analysis.
+
+## The first stage (delivery technique)
+
+The attack kicks off with a spear-phishing email sent from the compromised info@tmcell address — a legitimate domain tied to TMCell (Altyn Asyr CJSC), Turkmenistan's main mobile telecom provider. The subject line reads "Cybersecurity Guidelines", making it look like an official advisory from a trusted source.
+
+
+
+The email carries an attachment named Cybersecurity.doc, which acts as the initial payload. When the recipient opens the document and enables macros (as prompted), an obfuscated VBA macro runs. This macro extracts a hex-encoded blob hidden in the document's structure (often within UserForm elements), cleans it up by stripping spaces and line breaks, converts it to binary, and drops it as CertificationKit.ini in the ProgramData folder.
+
+
+
+
+
+