Tailcat exposes Tailscale’s WireGuard data plane without the Tailscale control plane

Tailscale released Tailcat on August 31 as an open-source Go package and CLI built from the same `magicsock` data-plane components used by Tailscale. Instead of enrolling devices in the Tailscale control plane, one side starts a Tailcat listener and shares a short connection token out of band; the other side uses that token to connect. Traffic is encrypted end-to-end with WireGuard, initial rendezvous can use DERP, and the library attempts NAT traversal to upgrade the connection to direct peer-to-peer UDP when possible. Tailcat does not change system routes or DNS and does not require a Tailscale account or administrator/root privileges. On September 25, Malwarebytes reported that newer versions of Kothamine Agent—malware linked to malicious npm packages—use Tailcat to receive commands over an encrypted connection. Malwarebytes says this removes a conventional command-and-control domain defenders could block; earlier Kothamine versions used the Tailscale VPN instead.

Tailscale’s easiest path normally combines an open-source networking data plane with Tailscale’s managed identity and coordination layer. Tailcat separates those layers in a supported public project, giving developers a small primitive for applications that need encrypted peer connectivity but want to own identity, authorization and connection metadata themselves. That can be useful for self-hosted tools, temporary peer transfers, developer utilities and embedded networking features. The cost of that freedom is operational: Tailcat is not a replacement control plane, its connection metadata must be exchanged securely by the application, and Tailscale provides no API, wire-format or relay SLA guarantees. The Kothamine finding now demonstrates the other side of that composability: the same control-plane-free encrypted connectivity can also be embedded by malware, reducing the usefulness of domain-based C2 blocking.

A Tailcat server produces a short token containing the information a peer needs to establish the session. How that token reaches the client is intentionally outside Tailcat’s scope. That makes the library composable, but it also shifts authentication, authorization, expiry and token-delivery decisions into the surrounding application.

Tailcat uses WireGuard for end-to-end encryption and Tailscale’s `magicsock` code for NAT traversal. Connections bootstrap through DERP, then try to establish direct UDP where the network permits it. This preserves much of the difficult peer-connectivity engineering without requiring a machine to join a managed tailnet.

Tailcat does not modify routing tables or DNS and does not require root or administrator privileges. The CLI behaves more like an encrypted NAT-traversing netcat, while the Go package lets another application embed the same connection behavior directly.

The default setup can use Tailscale’s free rate-limited DERP relays, but the project also supports self-hosted DERP infrastructure. Tailscale explicitly describes the public relays as best-effort, with no uptime or throughput commitment, so production users that depend on relay availability need to make that trade-off explicit.

Malwarebytes says newer Kothamine Agent samples use Tailcat for command delivery over encrypted connections and are linked to malicious npm packages. Because the malware does not need a conventional C2 domain for that channel, defenders lose one straightforward network-blocking indicator. This does not make Tailcat malicious; it demonstrates a predictable dual-use consequence of packaging encrypted NAT-traversing connectivity as an embeddable library.