Mirage Kitten APT Deploys NodeRabbit and PollCat Backdoors via Trojanized Coding Challenges

The Mirage Kitten APT group has launched a new campaign targeting software engineers within the aviation and FinTech sectors. The campaign utilizes a sophisticated delivery mechanism involving fake recruiter outreach on professional networking platforms like LinkedIn. Victims are invited to complete technical coding assessments, which are hosted on Amazon S3 buckets. These archives contain trojanized software development projects - specifically an application named TaskFlow - that include malicious npm packages such as 'colorized_terminal' (v2.1.0) and 'pretty-log' (v2.1.0).

Once executed, these packages trigger the installation of 'NodeRabbit', a previously undocumented, cross-platform remote access trojan (RAT) written in Node.js. NodeRabbit is capable of executing arbitrary shell commands, performing system reconnaissance, and establishing persistent backdoors on Windows, Linux, and macOS systems. During the same investigation, researchers identified a secondary RAT named 'PollCat', written in obfuscated JavaScript. This represents a significant shift in the group's tradecraft from native C/C++ or Go malware to high-level language-based implants, likely intended to blend into developer environments.

Attack Chain

1. Mirage Kitten operators perform reconnaissance and reach out to targets on job search platforms posing as recruiters.
2. The target receives a link to a project archive (e.g., Front-Technical-Challenge.zip) hosted on Amazon S3.
3. The victim downloads and extracts the archive, which includes a malicious npm package dependency in the node_modules directory.
4. Upon running the development project, the malicious package executes an implant from node_modules/.cache/.320697f1/index.js as a background process.
5. The implant (NodeRabbit) generates a unique agent ID based on host system metadata and attempts to bind to a local TCP port to ensure single-instance operation.
6. Persistence is established: via Windows Registry Run keys for nodew.exe, cron jobs on Linux, or LaunchAgents on macOS.
7. The malware initiates beaconing to Azure-hosted C2 infrastructure using AES-256-GCM encrypted JSON payloads.
8. The final objective is achieved via arbitrary command execution and exfiltration of system information or developer assets.

Impact

The campaign targets high-value individuals within the aviation and FinTech sectors, posing a significant risk of intellectual property theft, unauthorized access to secure development environments, and potential follow-on compromise of critical corporate infrastructure. The usage of job search lures exploits the trust relationship inherent in the hiring process, making it difficult for standard email filters to flag the activity.

Recommendation

1. Deploy the Sigma rules below to monitor for suspicious process execution patterns related to Node.js implants.
2. Block outbound connections to the identified Azure-hosted C2 infrastructure at the network perimeter.
3. Implement strict controls on the execution of developer environments; verify the integrity of node_modules and external project dependencies before execution.
4. Hunt for the presence of the identified malicious file paths and registry modifications on developer workstations.