Mirage Kitten Targets Middle East and Africa with New Malware Suite
APT group Mirage Kitten has deployed a new arsenal of custom malware, including the NightLedger backdoor and ArcBridge/BridgeHead tunnelers, in cyber-espionage campaigns against the Middle East and Africa.
The advanced persistent threat (APT) group known as Mirage Kitten, also tracked under aliases such as UNC1549, Smoke Sandstorm, and Nimbus Manticore, has been observed deploying a sophisticated new suite of custom malware. This group primarily focuses on cyber-espionage operations, targeting sectors like aerospace, aviation, defense, and telecommunications across the Middle East and Europe. Their modus operandi involves highly targeted spear-phishing campaigns, the creation of fake recruitment portals, and the use of multi-stage malware to achieve persistent access and exfiltrate sensitive data.
Recent threat research has uncovered previously undocumented malware tools developed and utilized by Mirage Kitten. The newly identified toolset includes "NightLedger," a Windows backdoor designed for reconnaissance, command execution, file operations, process discovery, and screenshot capture. Complementing the backdoor are two custom WebSocket-based tunnelers, "ArcBridge" and "BridgeHead," which facilitate covert network access and operator-controlled tunneling, enabling more stealthy command and control communications.
While the precise initial access vector for many of the observed malware samples remains unclear, security researchers have confirmed the deployment of the BridgeHead tunneler within victim environments. Specifically, BridgeHead was observed in post-exploitation activities in Egypt and at an aerospace and aviation organization based in Pakistan. This deployment typically follows targeted spear-phishing campaigns that employ highly tailored social engineering lures, impersonating trusted brands and recruitment platforms, or mimicking legitimate videoconferencing pages to trick victims into downloading malicious archives.
The NightLedger backdoor is a significant component of this new toolset. It masquerades as a legitimate DLL file, SspiCli.dll, and is designed to exploit DLL search-order hijacking vulnerabilities, targeting the AppVShNotify.exe binary. Although the target binary does not directly import SspiCli.dll, it can indirectly load the malicious DLL through its import of RPCRT4.dll. This allows the malicious DLL to execute while forwarding legitimate functions, maintaining a semblance of normal operation. To ensure exclusivity, the backdoor creates a unique mutex, "A8215357-F99A-44FE-BC65-D8F0434B0C03," and terminates if it already exists.
NightLedger communicates with its command and control (C2) servers over HTTPS, using specific endpoints like /edfcvfgbhnjmkqwasderfgg on the realhealthshop[.]com domain, with tjconsultingservices[.]com serving as a fallback. The implant tokenizes C2 payloads using a custom delimiter (#%%#) before passing them to its command dispatcher. This technique bears resemblance to the "TWOSTROKE" backdoor, also attributed to Mirage Kitten, which uses a similar approach with a different delimiter (@##@) and hex-encoded responses. NightLedger supports a wide array of commands, including gathering system information, executing processes, file operations, updating beacon intervals, taking screenshots, and uploading/downloading files.
The BridgeHead tunneler, deployed as unbcl.dll or libwinpthread-1.dll in different observed instances, establishes an HTTPS WebSocket connection to its C2 server. It performs a username check, potentially to prevent execution in analysis environments, before initiating the connection. The malware dynamically resolves and uses Windows API functions to establish the WebSocket tunnel. After a successful upgrade to the WebSocket protocol, the client authenticates with the server using a binary message containing the literal string "token." The server's response dictates the subsequent actions, with specific HTTP status codes like 407 (Proxy Auth Required) triggering further authentication attempts using Negotiate or NTLM protocols, while a 101 (Switching Protocols) indicates success and allows the tunneling to proceed.
This latest campaign highlights Mirage Kitten's continued evolution and adaptation in its cyber-espionage efforts. The group's persistent targeting of sensitive sectors in the Middle East and Africa, coupled with the development of new, sophisticated tools like NightLedger and the BridgeHead tunneler, underscores the ongoing threat they pose. The use of covert tunneling and advanced evasion techniques suggests a focus on maintaining long-term access and minimizing detection, making attribution and mitigation increasingly challenging for security teams.