Attack Chain

1. Initial Access via Spear-Phishing: Mirage Kitten conducts highly targeted spear-phishing campaigns using social engineering lures, such as fake recruitment content or lookalike videoconferencing pages, specifically tailored for their targets.
2. Malicious File Delivery: Victims are redirected to malicious archives hosted on third-party file-sharing services, which contain the initial malware payload.
3. DLL Search-Order Hijacking (NightLedger): The NightLedger backdoor, masquerading as SspiCli.dll, is deployed to perform DLL search-order hijacking, targeting the legitimate Windows binary AppVShNotify.exe to achieve execution.
4. Mutex Creation: NightLedger creates a mutex (A8215357-F99A-44FE-BC65-D8F0434B0C03) to ensure only a single instance of the backdoor is running on the infected system, immediately exiting if the mutex already exists.
5. C2 Communication (NightLedger): NightLedger establishes periodic HTTPS communication with its primary C2 server realhealthshop[.]com or fallback C2 tjconsultingservices[.]com to receive commands and upload collected data.
6. Reconnaissance and Execution (NightLedger): The backdoor performs reconnaissance (gathering user, host, network information, listing processes, enumerating drives), executes commands, handles file operations (download, copy, delete, upload), and captures screenshots.
7. BridgeHead Deployment and Evasion: The BridgeHead tunneler (e.g., unbcl.dll, libwinpthread-1.dll) is deployed in specific directories and performs a username check for a specific substring, intended to prevent execution in virtual analysis environments.
8. Covert Tunneling (BridgeHead): BridgeHead establishes an authenticated WebSocket SOCKS5 tunnel to its C2 (smartconnect.azurewebsites.net), handling corporate proxy traversal (e.g., HTTP 407, NTLM/Negotiate authentication) to provide operator-controlled network access and facilitate further lateral movement or data exfiltration.

Impact

Mirage Kitten's cyber-espionage operations have severe consequences for targeted organizations within the aerospace, aviation, defense, and telecommunications sectors. Successful attacks result in persistent network compromise, unauthorized access to sensitive systems, and exfiltration of classified or proprietary data. This can lead to significant intellectual property theft, national security risks, and substantial financial and reputational damage. The group has actively targeted entities in Egypt and a Pakistan-based aerospace and aviation organization, demonstrating a focused effort against critical infrastructure and high-value intelligence targets.

Recommendation

• Deploy the Sigma rules provided in this brief to detect the custom malware components NightLedger and BridgeHead.
• Block communication with the identified C2 domains realhealthshop[.]com, tjconsultingservices[.]com, and smartconnect.azurewebsites.net at the network perimeter (DNS resolver, firewall, proxy).
• Monitor for image_load events on Windows endpoints where AppVShNotify.exe loads SspiCli.dll from non-standard system paths, as identified in the detection rules.
• Investigate outbound network connections, specifically HTTPS WebSocket traffic, to smartconnect.azurewebsites.net using the unique User-Agent string from the provided rules.
• Implement robust email security solutions and conduct regular user awareness training to educate employees about sophisticated spear-phishing tactics and prevent initial access.
• Enable comprehensive process_creation and file_event logging on Windows endpoints to capture activity related to NightLedger and BridgeHead DLL deployment and execution.