Kothamine Malware Hides Behind Tailscale’s ‘tailcat’ to Evade Traditional Network Defences
A malware strain dubbed Kothamine uses Tailscale’s legitimate tailcat component to receive attacker commands over encrypted connections, avoiding the malicious domains security teams usually block. The case shows how trusted networking tools can double as covert control channels inside corporate networks.
Researchers have described how new malware known as Kothamine turns a legitimate networking utility into its control channel, making it much harder to spot and block.
Kothamine uses Tailscale’s real “tailcat” tool to communicate with its operators. Tailcat is part of a widely used mesh‑networking service, so its encrypted traffic can look like routine administration activity rather than a sign of compromise.
Instead of reaching out to obvious command‑and‑control servers tied to suspicious domain names, an infected system uses tailcat to establish an encrypted connection that carries instructions between the attacker and the compromised machine. Because this traffic rides over infrastructure that many organisations already trust, there may be no clearly malicious domain for defenders to blacklist.
That creates a problem for security models that still lean heavily on blocking known bad destinations or scanning for tell‑tale URLs. If a company already allows Tailscale tools on its network, Kothamine’s traffic can blend into the background of normal remote‑access and management flows.
The episode underlines a broader shift: attackers are increasingly abusing legitimate services and software rather than standing up their own infrastructure. Cloud platforms, messaging apps and now commercial mesh‑networking tools have all been turned to this purpose.
For organisations that rely on tools like Tailscale, the Kothamine case is a warning that trust in widely deployed utilities can be abused. The practical response will have to focus less on domain reputation and more on behaviour inside the network—what processes are doing, which tools they launch and whether that activity fits normal patterns.
Sources
- OSINT