[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyWfbrB2wyTKaFcNcbywhN7MuwQl46tsJR29D4m7_6og":3},{"article":4,"iocs":48,"watch_terms":65,"solutions":66,"lesson":155},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"2a8f7504-dd4b-44c4-8fef-8c6699af2053","Mirage Kitten targets Middle East and Africa region with new malware","mirage-kitten-targets-middle-east-and-africa-region-with-new-malware-ceefdc","Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.","Kaspersky researchers have documented a previously undisclosed malware toolkit attributed to Mirage Kitten (also tracked as UNC1549, Smoke Sandstorm, and Nimbus Manticore), an APT group targeting aerospace, aviation, defense, and telecommunications sectors in the Middle East and Africa. The toolkit includes NightLedger, a Windows backdoor capable of reconnaissance, command execution, file operations, and screenshot capture, along with two WebSocket-based tunneling tools, ArcBridge and BridgeHead, used for covert network access. The malware is deployed following spear-phishing campaigns using recruitment-themed lures and lookalike videoconferencing pages.","Kaspersky reveals Mirage Kitten's new malware toolkit: NightLedger backdoor and WebSocket tunnelers targeting Middle","https:\u002F\u002Fsecurelist.com\u002Fmirage-kitten-new-tools\u002F120811\u002F","https:\u002F\u002Fmedia.kasperskycontenthub.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F43\u002F2026\u002F07\u002F24115535\u002FSL-Mirage-Kitten-featured-scaled.jpg","2026-07-28T08:00:20+00:00","2026-07-28T10:00:04.485384+00:00",9,[17,20,22,24,26,29],{"name":18,"type":19},"Mirage Kitten","threat_actor",{"name":21,"type":19},"UNC1549",{"name":23,"type":19},"Smoke Sandstorm",{"name":25,"type":19},"Nimbus Manticore",{"name":27,"type":28},"Kaspersky","vendor",{"name":30,"type":31},"DLL search-order hijacking","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53,56,59,62],{"type":50,"value":51,"context":52},"domain","realhealthshop.com","Primary C2 server for NightLedger backdoor, contacted via HTTPS GET requests to \u002Fedfcvfgbhnjmkqwasderfgg endpoint",{"type":50,"value":54,"context":55},"tjconsultingservices.com","Fallback C2 server for NightLedger backdoor",{"type":36,"value":57,"context":58},"NightLedger","Windows backdoor attributed to Mirage Kitten, masquerades as SspiCli.dll for DLL search-order hijacking",{"type":36,"value":60,"context":61},"ArcBridge","WebSocket-based tunneling tool attributed to Mirage Kitten for covert network access",{"type":36,"value":63,"context":64},"BridgeHead","WebSocket-based tunneler attributed to Mirage Kitten, deployed during post-exploitation in Egypt and Pakistan",[27],{"controls":67,"vendors":154},[68,97,125],{"slug":69,"name":70,"problem":71,"products":72},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":47,"name":98,"problem":99,"products":100},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"slug":126,"name":127,"problem":128,"products":129},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[130,138,146],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",[],{"slug":156,"title":157,"body":158,"framework_refs":159,"framework_notes":172},"mirage-kitten-apt-deploys-covert-backdoor-via-spear-phishing-lures","Mirage Kitten APT Deploys Covert Backdoor via Spear-Phishing Lures","The Mirage Kitten APT group successfully infiltrated high-value targets in aerospace, defense, and telecommunications by exploiting human trust through spear-phishing emails using convincing recruitment-themed lures and fake videoconferencing pages. Once inside, attackers deployed the NightLedger backdoor alongside WebSocket-based tunneling tools to maintain covert, persistent access while blending into legitimate network traffic. This campaign highlights the dual threat of sophisticated social engineering combined with advanced malware specifically designed to evade detection. Organizations in critical sectors remain prime targets because their data and infrastructure hold strategic intelligence value, making robust employee awareness and network visibility non-negotiable.",[160,161,162,163,164,165,166,167,168,169,170,171],"CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-61: Incident Handling Guide","NIST SP 800-94: Guide to Intrusion Detection and Prevention Systems","NIST AC-17: Remote Access","NIST SI-3: Malicious Code Protection","MITRE ATT&CK T1566.001: Spearphishing Attachment","MITRE ATT&CK T1090: Proxy \u002F Tunneling","MITRE ATT&CK T1113: Screen Capture","NIST CSF DE.CM-1: Network Monitoring","ISO 27001 A.12.2: Protection from Malware",{}]