MalKamak's GhostShell Campaign Hits Middle East, U.S., and Europe

MalKamak is an Iranian threat actor first documented by Cybereason in October 2021, found to have operated undetected since at least 2018. The group conducts targeted cyber espionage against aerospace and defense companies and telecommunications providers across the Middle East, the United States, Russia, and Europe. Its primary tool is ShellClient, a modular remote access trojan that evolved from a simple reverse shell into a sophisticated espionage implant across multiple development iterations. ShellClient's most distinctive feature is its use of Dropbox as a command and control channel — receiving attacker commands from files stored in a Dropbox account and uploading exfiltrated data to the same location — enabling command and control traffic to blend into legitimate cloud service communications and evade network detection. Cybereason noted possible code-level connections to the Chafer (APT39) and Agrius clusters, suggesting potential personnel or infrastructure overlap. MalKamak maintains a very low operational profile with few samples, consistent with a highly selective targeting approach directed at a small set of high-value intelligence targets.