Mirage Kitten Targets Aviation and FinTech with New Node.js and JavaScript Malware
APT group Mirage Kitten is employing novel Node.js and JavaScript-based remote access trojans, NodeRabbit and PollCat, delivered via spear-phishing campaigns targeting the aviation and FinTech sectors in the Middle East and Africa.
The advanced persistent threat (APT) group known as Mirage Kitten has been observed deploying new, sophisticated malware families, NodeRabbit and PollCat, marking a significant evolution in their operational tactics. These cross-platform remote access trojans (RATs), written in Node.js and obfuscated JavaScript respectively, represent the group's first publicly documented use of these technologies, a departure from their historical reliance on native malware.
Mirage Kitten's modus operandi involves spear-phishing campaigns, primarily utilizing LinkedIn and other job search platforms to deliver trojanized coding challenge archives. These archives are designed to appear as legitimate technical assessments for software engineering roles. By embedding malicious code within these archives, the attackers trick unsuspecting candidates into executing the malware when attempting to complete the coding challenges.
The NodeRabbit RAT, discovered on systems in Afghanistan, Egypt, and Ethiopia, is a cross-platform tool capable of infecting Windows, Linux, and macOS. Its initial infection vector involves a trojanized npm package, such as colorized_terminal or pretty-log, which silently launches the implant as a background process. The malware establishes persistence by copying itself to specific system locations and creating scheduled tasks or launch agents, depending on the operating system.
Following a successful infection, NodeRabbit generates a unique agent identifier by hashing various host information, including the hostname, username, OS version, architecture, and MAC address. It then establishes a TCP listener on localhost to ensure only a single instance of the malware runs. Communication with the command-and-control (C2) server is facilitated through this established connection, allowing operators to remotely control the compromised system.
Alongside NodeRabbit, the group is also deploying PollCat, another cross-platform RAT written in obfuscated JavaScript. While sharing a similar delivery mechanism through trojanized coding challenges, PollCat exhibits a substantially different internal structure, indicating a diversified toolkit for different operational needs or stages.
This shift towards Node.js and JavaScript-based malware signifies a strategic move by Mirage Kitten to leverage modern development frameworks, potentially to evade traditional signature-based detection methods and to exploit the ubiquity of these technologies in software development environments. The targeting of the aviation and FinTech sectors in the Middle East and Africa suggests a focus on high-value targets for espionage or financial gain.
Kaspersky's threat intelligence indicates that Mirage Kitten has historically employed techniques such as DLL search-order hijacking with native malware. The adoption of these new, script-based RATs demonstrates the group's adaptability and willingness to incorporate new tools and techniques into their arsenal to maintain operational effectiveness and achieve their objectives against critical infrastructure and financial institutions.