MarkiRAT Malware Removal: Fake VPNs and svehost.exe

MarkiRAT is a Windows remote-access Trojan, not a legitimate part of a VPN or media player. If you ran a package advertised as Pis2ray VPN, StarVPN, YESHICA, or YEPlayer and now see suspicious processes, disconnect the PC from the internet before using email, banking, messaging, or a password manager. Remove the fake app, scan for the RAT and its persistence, and recover exposed accounts from a different trusted device.

A filename alone is not enough to diagnose an infection. The strongest warning is a package from an unofficial site or social-media link followed by the documented names, paths, BITS activity, or a misspelled svehost.exe process. Do not delete the legitimate Windows svchost.exe because the names look similar.

What is MarkiRAT?

MarkiRAT is a Windows RAT tracked by MITRE as S0652. Historical versions can run commands, capture keystrokes and clipboard data, take screenshots, search for documents and password-manager files, upload data, and download more tools. They can communicate over HTTP or HTTPS, use BITS, and start again through Startup folders, Run keys, or modified shortcuts.^[2]

That capability changes the cleanup decision. Stopping one visible process does not prove that the computer is safe, and a clean scan cannot reverse passwords or session tokens that may already have been captured. MarkiRAT removal must include persistence checks and account recovery, not only file deletion.

Which fake VPN and media-player downloads were reported?

In 2026, Recorded Future’s Insikt Group documented TAG-182 infrastructure distributing MarkiRAT through VPN and media-player lures aimed mainly at Farsi-speaking users. The report names Pis2ray VPN, a StarVPN-themed page, YESHICA, and YESHICA YEPlayer. Documented packages included Pis2rayVPN.msi, Pis2rayVPN.zip, Pis2rayN.dll, YEMPlayer.msi, YEMPlayer.zip, and YEPlayer.dll.^[1]

Do not generalize these findings to every app with a similar name. The documented combination of source, package, path, process, and network behavior matters more than a single filename.

Is svehost.exe malware or the Windows svchost.exe process?

The spelling is the first check: the normal Windows host process is svchost.exe. MarkiRAT has masqueraded as svehost.exe, adding an extra letter e. The 2026 campaign placed that lookalike at C:\Users\Public\AppData\Windows\svehost.exe.^[1]

In Task Manager, right-click the process and choose Open file location, then open Properties → Digital Signatures. Record the exact path and signature before quarantining anything. The broader suspicious startup app checklist helps distinguish an unfamiliar but legitimate item from persistence.

Check BITS and startup persistence

BITS is a legitimate Windows transfer service, so the presence of a BITS job is not automatically malicious. The documented MarkiRAT activity used it to transfer a payload and communicate with attacker infrastructure. Open PowerShell as Administrator and list the jobs first:

Import-Module BitsTransfer
Get-BitsTransfer -AllUsers |
  Format-List DisplayName,JobId,OwnerAccount,JobState,RemoteName,LocalName

Look for the campaign job name pdj, an unknown remote host, or a local destination such as %PUBLIC%\AppData\Libs\p.b. Do not cancel Windows Update or another recognized job. If one job is clearly tied to the malicious package, inspect it by its exact ID and preview removal:

$job = Get-BitsTransfer -JobId "{suspicious-job-guid}"
$job | Format-List *
$job | Remove-BitsTransfer -WhatIf

After confirming the owner, remote source, and local path are malicious, repeat the last command without -WhatIf. Microsoft’s Remove-BitsTransfer documentation notes that cancelling a job removes its transfers, temporary files, and job object, which is why broad removal of every BITS job is unsafe.^[3]

Then check Task Manager’s Startup apps, Task Scheduler, Services, the Startup folders, and Run keys. Microsoft’s Autoruns utility can show logon entries, services, scheduled tasks, shortcuts, and other autostart locations; use its signature-verification and Microsoft-entry filters to narrow the list without deleting unfamiliar items blindly.^[4]

Remove MarkiRAT and check for persistence

1. Disconnect the affected PC. Disable Wi-Fi and unplug Ethernet. Do not sign in to sensitive accounts from it.
2. Preserve the timeline. Note the download page, social-media post, filenames, install time, process path, protection alerts, and suspicious BITS or startup entries. A work device should be handed to the security team before manual cleanup.
3. Remove the lure application. Use Settings → Apps → Installed apps when the fake VPN or player has an uninstall entry. Do not accept an update or run an uninstaller downloaded from the same suspicious page.
4. Quarantine the confirmed lookalikes and payloads. Use the security tool’s quarantine after verifying the path. Do not delete C:\Windows\System32\svchost.exe or another signed Windows file.
5. Run a full malware scan. Scan with updated protection after the manual containment. Use Gridinsoft Anti-Malware to check the fake package, dropped files, startup entries, scheduled jobs, services, and other persistence, then remove confirmed detections.
6. Review BITS and autostarts. Remove only entries that match the suspicious package, path, job, or command you verified. Reboot and list them again.
7. Run an offline scan. In Windows Security, open Virus & threat protection → Scan options → Microsoft Defender Offline scan. Save work first because the PC restarts.
8. Recheck after reboot. Confirm that svehost.exe, the suspicious BITS job, startup entry, and unexpected network connection do not return. If remote access or security-tool tampering continues, reinstall Windows from trusted media.

The visible fake app or svehost.exe process may be only one component. A loader, scheduled job, service, Startup entry, modified shortcut, or downloaded tool can remain after the first file is removed and recreate the activity.

Recover accounts after a suspected MarkiRAT infection

Because MarkiRAT can capture keystrokes, clipboard contents, screenshots, files, and password-manager data, use a separate clean device for recovery.^[2]

1. Start with the primary email account and password manager. Change the passwords and enable phishing-resistant multi-factor authentication where available.
2. Revoke active browser, email, cloud, messaging, social-media, and work sessions. A password change does not always invalidate every session token.
3. Rotate credentials entered, copied, or visible on screen while the suspicious software was installed. Replace reused passwords everywhere.
4. If a KeePass database, private key, recovery phrase, or sensitive document was accessible, follow the provider’s clean-device recovery procedure. A scan cannot retrieve a secret already copied by an attacker.
5. Review sent messages and warn contacts if the account may have delivered files or links. Monitor financial and work accounts for unauthorized actions.

Fake conferencing installers have delivered other RATs through a similar trust trick. The Starland RAT fake-installer guide explains why a familiar software name must be verified against its source and execution path.

Are TAG-182 and Ferocious Kitten the same actor?

Not as a proven organizational identity. MITRE records historical MarkiRAT use by Ferocious Kitten. Recorded Future found BITS and malware-tradecraft overlap between the 2026 TAG-182 activity and older variants, but stated that more evidence is needed to confidently establish that the clusters are organizationally linked.^[1] For a home user, that uncertainty does not change the containment steps: a documented fake package and surveillance RAT still require cleanup and credential recovery.

FAQ

References

1. Recorded Future Insikt Group. “Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool.” Recorded Future, accessed July 23, 2026. Primary campaign research and indicators.
2. MITRE ATT&CK. “MarkiRAT, Software S0652.” The MITRE Corporation, last modified April 25, 2025; accessed July 23, 2026. Software behavior and technique record.
3. Microsoft. “Remove-BitsTransfer.” Microsoft Learn, accessed July 23, 2026. BITS job cancellation reference.
4. Mark Russinovich. “Autoruns v14.3.” Microsoft Sysinternals, June 17, 2026. Official autostart inspection utility.