Mirage Kitten Targets Middle East and Africa with New Malware

Mirage Kitten, also known as UNC1549, Smoke Sandstorm, and Nimbus Manticore, is an advanced persistent threat (APT) group primarily focused on cyber-espionage operations. Since at least 2026-07, they have been observed deploying a new custom malware toolset, including the NightLedger Windows backdoor and the ArcBridge and BridgeHead WebSocket-based tunnelers. The group primarily targets aerospace, aviation, defense, and telecommunications sectors in the Middle East and Europe. Initial access is typically gained through highly targeted spear-phishing campaigns, fake recruitment portals, and malicious archives hosted on file-sharing services. The new tools enable extensive reconnaissance, command execution, file operations, data exfiltration, and covert network access through SOCKS5 tunneling, posing a significant threat of persistent compromise and sensitive data loss for affected organizations.

Attack Chain

1. Initial Access via Spear-Phishing: Mirage Kitten conducts highly targeted spear-phishing campaigns using social engineering lures, such as fake recruitment content or lookalike videoconferencing pages, specifically tailored for their targets.
2. Malicious File Delivery: Victims are redirected to malicious archives hosted on third-party file-sharing services, which contain the initial malware payload.
3. DLL Search-Order Hijacking (NightLedger): The NightLedger backdoor, masquerading as SspiCli.dll, is deployed to perform DLL search-order hijacking, targeting the legitimate Windows binary AppVShNotify.exe to achieve execution.
4. Mutex Creation: NightLedger creates a mutex (A8215357-F99A-44FE-BC65-D8F0434B0C03) to ensure only a single instance of the backdoor is running on the infected system, immediately exiting if the mutex already exists.
5. C2 Communication (NightLedger): NightLedger establishes periodic HTTPS communication with its primary C2 server realhealthshop[.]com or fallback C2 tjconsultingservices[.]com to receive commands and upload collected data.
6. Reconnaissance and Execution (NightLedger): The backdoor performs reconnaissance (gathering user, host, network information, listing processes, enumerating drives), executes commands, handles file operations (download, copy, delete, upload), and captures screenshots.
7. BridgeHead Deployment and Evasion: The BridgeHead tunneler (e.g., unbcl.dll, libwinpthread-1.dll) is deployed in specific directories and performs a username check for a specific substring, intended to prevent execution in virtual analysis environments.
8. Covert Tunneling (BridgeHead): BridgeHead establishes an authenticated WebSocket SOCKS5 tunnel to its C2 (smartconnect.azurewebsites.net), handling corporate proxy traversal (e.g., HTTP 407, NTLM/Negotiate authentication) to provide operator-controlled network access and facilitate further lateral movement or data exfiltration.

Impact

Mirage Kitten's cyber-espionage operations have severe consequences for targeted organizations within the aerospace, aviation, defense, and telecommunications sectors. Successful attacks result in persistent network compromise, unauthorized access to sensitive systems, and exfiltration of classified or proprietary data. This can lead to significant intellectual property theft, national security risks, and substantial financial and reputational damage. The group has actively targeted entities in Egypt and a Pakistan-based aerospace and aviation organization, demonstrating a focused effort against critical infrastructure and high-value intelligence targets.

Recommendation

• Deploy the Sigma rules provided in this brief to detect the custom malware components NightLedger and BridgeHead.
• Block communication with the identified C2 domains realhealthshop[.]com, tjconsultingservices[.]com, and smartconnect.azurewebsites.net at the network perimeter (DNS resolver, firewall, proxy).
• Monitor for image_load events on Windows endpoints where AppVShNotify.exe loads SspiCli.dll from non-standard system paths, as identified in the detection rules.
• Investigate outbound network connections, specifically HTTPS WebSocket traffic, to smartconnect.azurewebsites.net using the unique User-Agent string from the provided rules.
• Implement robust email security solutions and conduct regular user awareness training to educate employees about sophisticated spear-phishing tactics and prevent initial access.
• Enable comprehensive process_creation and file_event logging on Windows endpoints to capture activity related to NightLedger and BridgeHead DLL deployment and execution.