Mirage Kitten targets Middle East and Africa region with new malware
Kaspersky reveals Mirage Kitten's new malware toolkit: NightLedger backdoor and WebSocket tunnelers targeting Middle
Kaspersky researchers have documented a previously undisclosed malware toolkit attributed to Mirage Kitten (also tracked as UNC1549, Smoke Sandstorm, and Nimbus Manticore), an APT group targeting aerospace, aviation, defense, and telecommunications sectors in the Middle East and Africa. The toolkit includes NightLedger, a Windows backdoor capable of reconnaissance, command execution, file operations, and screenshot capture, along with two WebSocket-based tunneling tools, ArcBridge and BridgeHead, used for covert network access. The malware is deployed following spear-phishing campaigns using recruitment-themed lures and lookalike videoconferencing pages.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Kaspersky?
Get an email when a new story names Kaspersky, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Mirage Kitten APT group successfully infiltrated high-value targets in aerospace, defense, and telecommunications by exploiting human trust through spear-phishing emails using convincing recruitment-themed lures and fake videoconferencing pages. Once inside, attackers deployed the NightLedger backdoor alongside WebSocket-based tunneling tools to maintain covert, persistent access while blending into legitimate network traffic. This campaign highlights the dual threat of sophisticated social engineering combined with advanced malware specifically designed to evade detection. Organizations in critical sectors remain prime targets because their data and infrastructure hold strategic intelligence value, making robust employee awareness and network visibility non-negotiable.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — realhealthshop.com
- domain — tjconsultingservices.com
- malware — NightLedger
- malware — ArcBridge
- malware — BridgeHead