{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/tunneler/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":["Mirage Kitten"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows"],"_cs_severities":["high"],"_cs_tags":["cyber-espionage","apt","windows","malware","backdoor","tunneler","dll-hijacking","websocket","spear-phishing"],"_cs_type":"threat","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eMirage Kitten, also known as UNC1549, Smoke Sandstorm, and Nimbus Manticore, is an advanced persistent threat (APT) group primarily focused on cyber-espionage operations. Since at least 2026-07, they have been observed deploying a new custom malware toolset, including the NightLedger Windows backdoor and the ArcBridge and BridgeHead WebSocket-based tunnelers. The group primarily targets aerospace, aviation, defense, and telecommunications sectors in the Middle East and Europe. Initial access is typically gained through highly targeted spear-phishing campaigns, fake recruitment portals, and malicious archives hosted on file-sharing services. The new tools enable extensive reconnaissance, command execution, file operations, data exfiltration, and covert network access through SOCKS5 tunneling, posing a significant threat of persistent compromise and sensitive data loss for affected organizations.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access via Spear-Phishing:\u003c/strong\u003e Mirage Kitten conducts highly targeted spear-phishing campaigns using social engineering lures, such as fake recruitment content or lookalike videoconferencing pages, specifically tailored for their targets.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMalicious File Delivery:\u003c/strong\u003e Victims are redirected to malicious archives hosted on third-party file-sharing services, which contain the initial malware payload.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDLL Search-Order Hijacking (NightLedger):\u003c/strong\u003e The NightLedger backdoor, masquerading as \u003ccode\u003eSspiCli.dll\u003c/code\u003e, is deployed to perform DLL search-order hijacking, targeting the legitimate Windows binary \u003ccode\u003eAppVShNotify.exe\u003c/code\u003e to achieve execution.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMutex Creation:\u003c/strong\u003e NightLedger creates a mutex (\u003ccode\u003eA8215357-F99A-44FE-BC65-D8F0434B0C03\u003c/code\u003e) to ensure only a single instance of the backdoor is running on the infected system, immediately exiting if the mutex already exists.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eC2 Communication (NightLedger):\u003c/strong\u003e NightLedger establishes periodic HTTPS communication with its primary C2 server \u003ccode\u003erealhealthshop[.]com\u003c/code\u003e or fallback C2 \u003ccode\u003etjconsultingservices[.]com\u003c/code\u003e to receive commands and upload collected data.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eReconnaissance and Execution (NightLedger):\u003c/strong\u003e The backdoor performs reconnaissance (gathering user, host, network information, listing processes, enumerating drives), executes commands, handles file operations (download, copy, delete, upload), and captures screenshots.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eBridgeHead Deployment and Evasion:\u003c/strong\u003e The BridgeHead tunneler (e.g., \u003ccode\u003eunbcl.dll\u003c/code\u003e, \u003ccode\u003elibwinpthread-1.dll\u003c/code\u003e) is deployed in specific directories and performs a username check for a specific substring, intended to prevent execution in virtual analysis environments.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCovert Tunneling (BridgeHead):\u003c/strong\u003e BridgeHead establishes an authenticated WebSocket SOCKS5 tunnel to its C2 (\u003ccode\u003esmartconnect.azurewebsites.net\u003c/code\u003e), handling corporate proxy traversal (e.g., HTTP 407, NTLM/Negotiate authentication) to provide operator-controlled network access and facilitate further lateral movement or data exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eMirage Kitten's cyber-espionage operations have severe consequences for targeted organizations within the aerospace, aviation, defense, and telecommunications sectors. Successful attacks result in persistent network compromise, unauthorized access to sensitive systems, and exfiltration of classified or proprietary data. This can lead to significant intellectual property theft, national security risks, and substantial financial and reputational damage. The group has actively targeted entities in Egypt and a Pakistan-based aerospace and aviation organization, demonstrating a focused effort against critical infrastructure and high-value intelligence targets.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rules provided in this brief to detect the custom malware components NightLedger and BridgeHead.\u003c/li\u003e\n\u003cli\u003eBlock communication with the identified C2 domains \u003ccode\u003erealhealthshop[.]com\u003c/code\u003e, \u003ccode\u003etjconsultingservices[.]com\u003c/code\u003e, and \u003ccode\u003esmartconnect.azurewebsites.net\u003c/code\u003e at the network perimeter (DNS resolver, firewall, proxy).\u003c/li\u003e\n\u003cli\u003eMonitor for \u003ccode\u003eimage_load\u003c/code\u003e events on Windows endpoints where \u003ccode\u003eAppVShNotify.exe\u003c/code\u003e loads \u003ccode\u003eSspiCli.dll\u003c/code\u003e from non-standard system paths, as identified in the detection rules.\u003c/li\u003e\n\u003cli\u003eInvestigate outbound network connections, specifically HTTPS WebSocket traffic, to \u003ccode\u003esmartconnect.azurewebsites.net\u003c/code\u003e using the unique User-Agent string from the provided rules.\u003c/li\u003e\n\u003cli\u003eImplement robust email security solutions and conduct regular user awareness training to educate employees about sophisticated spear-phishing tactics and prevent initial access.\u003c/li\u003e\n\u003cli\u003eEnable comprehensive \u003ccode\u003eprocess_creation\u003c/code\u003e and \u003ccode\u003efile_event\u003c/code\u003e logging on Windows endpoints to capture activity related to NightLedger and BridgeHead DLL deployment and execution.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T08:09:56Z","date_published":"2026-07-28T08:09:56Z","id":"https://feed.craftedsignal.io/briefs/2026-07-mirage-kitten-new-malware/","summary":"Mirage Kitten, an advanced persistent threat (APT) group, is deploying new Windows backdoor (NightLedger) and WebSocket tunnelers (ArcBridge, BridgeHead) via spear-phishing campaigns to conduct cyber-espionage and data exfiltration against aerospace, aviation, defense, and telecommunications sectors in the Middle East and Europe.","title":"Mirage Kitten Targets Middle East and Africa with New Malware","url":"https://feed.craftedsignal.io/briefs/2026-07-mirage-kitten-new-malware/"}],"language":"en","title":"CraftedSignal Threat Feed - Tunneler","version":"https://jsonfeed.org/version/1.1"}