Actors Insights|Latest update24/07/2026

MalKamak

Named by CybereasonSuspected state sponsor: Islamic Republic of Iran

MalKamak is an Iranian threat actor first documented by Cybereason in October 2021, found to have operated undetected since at least 2018. The group conducts targeted cyber espionage against aerospace and defense companies and telecommunications providers across the Middle East, the United States, Russia, and Europe. Its primary tool is ShellClient, a modular remote access trojan that evolved from a simple reverse shell into a sophisticated espionage implant across multiple development iterations. ShellClient's most distinctive feature is its use of Dropbox as a command and control channel — receiving attacker commands from files stored in a Dropbox account and uploading exfiltrated data to the same location — enabling command and control traffic to blend into legitimate cloud service communications and evade network detection. Cybereason noted possible code-level connections to the Chafer (APT39) and Agrius clusters, suggesting potential personnel or infrastructure overlap. MalKamak maintains a very low operational profile with few samples, consistent with a highly selective targeting approach directed at a small set of high-value intelligence targets.

First Seen:Jan 2018
Last Seen:Oct 2021
Indexed Reports:2
Public IOCs:26
Cluster: UnclassifiedMisp: MalKamak
also known as:
MalKamak (Cybereason)

Targeted Regions

Europe
EU
Europe
Europe
Jan 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Middle East
ME
Middle East
Middle East
Jan 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Russia
RU
Russia
Russia
Jan 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
United States
US
United States
United States
Jan 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Nov 2018 ~ Oct 2021
Jan 2018 ~ Oct 2021
Jan 2018Aug 2026

Targeted Sectors

AerospaceTelecommunication

Recent Indexed Reports

  1. Public
    MalKamak Targets Middle Eastern Aerospace and Telecom Firms with ShellClient RAT
  2. Public
    MalKamak's GhostShell Campaign Hits Middle East, U.S., and Europe

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.