Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 19:51:39 UTC
Home > List all groups > List all tools > List all groups using tool zhCat
 Tool: zhCat
Names zhCat
Category Malware
Type Tunneling
Description
(Cylance) zhCat is a tool developed by the Operation Cleaver team which operates similarly to
NetCat. Its main purpose is to create a channel that is capable of transporting information over
the network. The changes made in zhCat allow for this information to be transferred with
inline obfuscation and/or encryption. This makes it more difficult to detect that privileged
information is being exfiltrated.
Information
<https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf>
Malpedia <https://malpedia.caad.fkie.fraunhofer.de/details/win.zhcat>
Last change to this tool card: 14 May 2020
Download this tool card in JSON format
All groups using tool zhCat
Changed Name Country Observed
APT groups
  Cutting Kitten, TG-2889 2012-Mar 2016
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=a3f17fa7-c340-412a-b10c-c4ab6a990622
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=a3f17fa7-c340-412a-b10c-c4ab6a990622
Page 1 of 1