[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fD9A2r7hXL_ESZH270veFhp7_7F0b3GdlNcIQAsyrryU":3},{"article":4,"iocs":51,"watch_terms":64,"solutions":65,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"80d608c4-4fe1-4042-b9e0-84d2d42db47a","Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set","mirage-kitten-targeting-aviation-and-fintech-sectors-across-the-middle-east-and--eac188","Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.","Kaspersky has identified new attacks by the Mirage Kitten APT group targeting aviation and FinTech sectors in the Middle East and Africa. The group is employing previously undocumented malware families, NodeRabbit and PollCat, both cross-platform RATs written in Node.js and JavaScript respectively. These are delivered via spear-phishing campaigns using trojanized coding challenge archives, a departure from their previous reliance on native malware.","Mirage Kitten APT group uses new Node.js and JavaScript malware for Middle East\u002FAfrica attacks.","https:\u002F\u002Fsecurelist.com\u002Fmirage-kitten-new-backdoors-noderabbit-pollcat\u002F121244\u002F","https:\u002F\u002Fmedia.kasperskycontenthub.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F43\u002F2026\u002F08\u002F31212151\u002FSL-NodeRabbit-PollCat-featured-scaled.jpg","2026-09-01T07:00:26+00:00","2026-09-01T08:00:19.225534+00:00",8,[17,20,23,25],{"name":18,"type":19},"Mirage Kitten","threat_actor",{"name":21,"type":22},"Node.js","product",{"name":24,"type":22},"JavaScript",{"name":26,"type":27},"RAT","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":28,"icon":30,"name":31,"slug":32},null,"Nation-state","nation-state",[34,39,41,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,56,60],{"type":53,"value":54,"context":55},"hash_md5","1EA83E4E4592B01E4ACAB63EB867BEE5","Trojanized coding challenge archive Front-Technical-Challenge.zip",{"type":57,"value":58,"context":59},"url","https:\u002F\u002Foracle-challenge.s3[.]us-east-1.amazonaws[.]com\u002FFront-Technical-Challenge.zip","Amazon S3 bucket hosting trojanized coding challenge archive",{"type":61,"value":62,"context":63},"domain","oracle-challenge.s3[.]us-east-1.amazonaws[.]com","Amazon S3 domain used for hosting malicious content",[21,24],{"controls":66,"vendors":150},[67,96,121],{"slug":68,"name":69,"problem":70,"products":71},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":50,"name":97,"problem":98,"products":99},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":117,"product_name":118,"url":119,"description":120},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"slug":122,"name":123,"problem":124,"products":125},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[126,134,142],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",[],{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":168},"apt-group-mirage-kitten-uses-trojanized-coding-challenges-to-deploy-novel-rats","APT Group Mirage Kitten Uses Trojanized Coding Challenges to Deploy Novel RATs","Mirage Kitten is leveraging spear-phishing campaigns disguised as legitimate coding challenges to deliver two previously unknown cross-platform remote access trojans, NodeRabbit and PollCat, targeting aviation and FinTech organizations across the Middle East and Africa. The use of trojanized archives exploits the trust professionals place in routine recruitment or skills-assessment workflows, making detection more difficult and social engineering more effective. The shift to Node.js and JavaScript-based malware broadens the attack surface to multiple operating systems, bypassing defenses tuned for traditional native malware signatures. This campaign highlights how advanced threat actors continuously evolve their tooling and delivery mechanisms to outpace organizational defenses and threat intelligence.",[156,157,158,159,160,161,162,163,164,165,166,167],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","CIS Control 13: Network Monitoring and Defense","NIST SP 800-61: Incident Handling Guide","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SA-8: Security and Privacy Engineering Principles","NIST SP 800-53 AT-2: Literacy Training and Awareness","MITRE ATT&CK T1566.001: Spearphishing Attachment","MITRE ATT&CK T1059.007: JavaScript Execution","MITRE ATT&CK T1027: Obfuscated Files or Information","ISO\u002FIEC 27001 A.12.2: Protection from Malware",{}]