Kaspersky researchers have found a new set of custom malware used by Mirage Kitten, a state-linked
spying group also tracked as UNC1549, Smoke Sandstorm, and Nimbus Manticore. The group is using
the tools, a backdoor called NightLedger and two hidden network tunnelling utilities, to break into
aerospace, aviation, defence, and telecoms organisations across the Middle East and Africa and
quietly steal data. The group usually gets in through fake job offers and lookalike video-call pages, so
staff at targeted organisations should be careful with unexpected recruitment messages.
1. Campaign Timeline
Kaspersky’s GReAT team documented a previously undocumented toolset it attributes to Mirage Kitten based on code and behavioural overlaps with the group’s historical implants. The researchers saw BridgeHead deployed during post exploitation in Egypt and at a Pakistan-based aerospace and aviation organisation, following spear-phishing consistent with tradecraft reported by Unit 42 and Check Point Research. ArcBridge first appeared in April 2026 in Middle East targeting. The group is gradually shifting from Microsoft Azure subdomain infrastructure to Cloudflare-backed domains, a change likely intended to complicate attribution.
2. Attack Details
Initial access
The initial vector is unclear for most samples, but deployments followed targeted spear-phishing using recruitment lures that impersonate trusted brands and hiring platforms, plus lookalike videoconferencing pages that redirect victims to malicious archives on third-party file-sharing services.
Execution
NightLedger masquerades as SspiCli.dll and abuses DLL search-order hijacking against a legitimate
AppVShNotify.exe, which delay-loads the malicious DLL through RPCRT4.dll while forwarding expected exports to the real library.
Command and control
NightLedger beacons over HTTPS to realhealthshop[.]com, falling back to tjconsultingservices[.]com, and parses tasking split by a custom #%%# delimiter before running one of 16 operator commands.
Lateral movement and tunnelling
Operators deploy the BridgeHead and ArcBridge WebSocket tunnelers as sideloaded DLLs, each gated to run only on a host whose Windows username contains a hardcoded substring, turning the machine into a covert SOCKS5 relay.
3. Payload Capabilities
- NightLedger backdoor Supports 16 commands covering host and network reconnaissance, process execution, file download and upload, directory and drive listing, screenshot capture, DLL loading, and process termination. It also collects C:\Windows\debug\NetSetup.log to map domain-join activity.
- BridgeHead tunneler Runs as a full SOCKS5 proxy over an HTTPS WebSocket, forwarding operator traffic throughthe victim network. It traverses corporate proxies by answering HTTP 407 with Negotiate or NTLM using the current user’s single sign-on credentials.
- ArcBridge tunneler Opens operator-selected tunnel sessions and resolves hostnames through OPEN and DNS commands, driven by an embedded configuration holding the C2 host, port, and an implant identifier.
- Per-target tailoring Each tunneler checks the lowercased Windows username for a hardcoded substring and exits silently if it is absent, limiting execution to intended hosts and frustrating sandbox analysis.
4. Adversary Toolkit
| Tool / Indicator | Type | Function |
| NightLedger | Windows backdoor (DLL) | Masquerades as SspiCli.dll; performs reconnaissance, command execution, file operations, screenshots, and communicates with its command-and-control (C2) server over HTTPS. |
| BridgeHead | Windows tunneler (DLL) | Provides a SOCKS5 relay over a WebSocket, allowing traffic to traverse corporate proxies using the current user’s sign-in context. |
| ArcBridge | Windows tunneler (DLL) | WebSocket tunneler that opens operator-selected proxy sessions and resolves hostnames using OPEN and DNS commands. |
5. Indicators of Compromise (IOCs)
- https://www.virustotal.com/gui/collection/8cba5f8e6c51a994e4e876409d6542a32bbd7e523d4859ad9e3cadab425f2413/iocs
6. Recommendations
- Hunt endpoints for the NightLedger mutex A8215357-F99A-44FE-BC65-D8F0434B0C03 and the ArcBridge mutex F56E68DA-4A89-46B4-9AC8-7290A7651000, plus rogue SspiCli.dll, unbcl.dll, and libwinpthread-1.dll in user-writable folders.
- Isolate and reimage any host showing DLL search-order hijack of AppVShNotify.exe, and hunt neighbouring machines, since each tunneler is tailored to a specific username and implies prior internal reconnaissance.
- Reset credentials for users and services on affected hosts, as BridgeHead reuses the logged-in user’s single sign-on context to authenticate through corporate proxies.
- Inspect outbound HTTPS and WebSocket traffic to azurewebsites.net subdomains and Cloudflare-backed domains, and alert on unexpected SOCKS5-style tunnelling from user workstations.
- Brief staff on Mirage Kitten’s recruitment-themed lures and fake videoconferencing pages, and block downloads of executable archives from third-party file-sharing services.
- Alert on NightLedger’s distinctive C2 URIs, /edfcvfgbhnjmkqwasderfgg, /wsdefvvbnhyuijkplmbgfrtt, and /qasxcdfvgbhnmyuioplkhnj, in proxy and web logs.
- Block the IOCs at their respective controls, https://www.virustotal.com/gui/collection/8cba5f8e6c51 a994e4e876409d6542a32bbd7e523d4859ad9e3cadab425f2413/iocs
7. Sources
- https://securelist.com/mirage-kitten-new-tools/120811
- https://unit42.paloaltonetworks.com/tracking-iran-apt-screening-serpens/
- https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-th
e-iranian-conflict/
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.
