Mirage Kitten Unveils New Malware Targeting Middle East and Africa

Mirage Kitten, also known as UNC1549, Smoke Sandstorm, and Nimbus Manticore, is a cyber-espionage group that has recently expanded its toolkit to include new malware targeting sectors such as aerospace, aviation, defense, and telecommunications in the Middle East and Africa. This group is known for its highly targeted spear-phishing campaigns, which often utilize fake recruitment portals and custom multi-stage malware to gain access to sensitive data.

Recent investigations have uncovered a previously undocumented malware set developed by Mirage Kitten. This includes NightLedger, a new Windows backdoor designed for reconnaissance, command execution, file operations, process discovery, and screenshot capture. Additionally, the toolkit features two custom WebSocket-based tunneling tools, ArcBridge and BridgeHead, which facilitate covert network access and operator-controlled tunneling.

While the initial access vector for most observed malware samples remains unclear, BridgeHead has been deployed during post-exploitation activities in environments in Egypt and at a Pakistan-based aerospace organization. This deployment followed targeted spear-phishing activities that align with tradecraft documented by various cybersecurity firms, including the use of tailored social engineering lures that impersonate trusted brands and redirect victims to malicious content.

NightLedger operates by masquerading as SspiCli.dll and employs DLL search-order hijacking techniques. It targets the legitimate AppVShNotify.exe binary, allowing it to load malicious code while maintaining the appearance of normal operations. The backdoor periodically contacts its command and control (C2) server over HTTPS, issuing requests that facilitate its operations.

During the investigation, a tunnel proxy was identified as unbcl.dll on a machine in Egypt, with a similar deployment in Pakistan. This tunneling tool checks the Windows username to ensure it runs only on specific machines, suggesting prior reconnaissance within the network. If the username check is successful, the tunneler establishes an HTTPS WebSocket connection, allowing the operator to control the victim’s machine remotely.

ArcBridge, another WebSocket tunneling tool, was first identified in April 2026 and shares similarities with NightLedger, including the use of a UUID-like mutex for single-instance execution. This tool also communicates over a WebSocket channel and waits for server-side control messages, further enhancing the group’s capabilities for covert operations.

Victims of Mirage Kitten's campaigns have been identified across several countries, including Egypt, Jordan, Tanzania, Pakistan, Ethiopia, and Burkina Faso. The group’s continued evolution of its malware arsenal reflects its commitment to cyber-espionage operations in these regions. NightLedger retains core functionalities similar to previous backdoors while introducing new capabilities, such as the ability to capture screenshots and collect specific log files.

Mirage Kitten's reliance on tunneling utilities aligns with previous reports of its operational methods. The group has shifted from using Microsoft Azure subdomains to Cloudflare-backed domains, likely to complicate attribution while maintaining resilient command-and-control communications. This ongoing adaptation highlights the persistent threat posed by Mirage Kitten and its sophisticated cyber-espionage tactics.