10 minhigh
Mirage Kitten targets Middle East and Africa region with new malware
Mirage Kitten has expanded its malware arsenal with NightLedger, a Windows backdoor abusing DLL search-order hijacking via a malicious SspiCli.dll, and two WebSocket-based tunneling tools (ArcBridge and BridgeHead) that establish SOCKS5 proxy relays through victim networks. The tools employ anti-analysis techniques such as username-substring checks, enterprise proxy traversal with NTLM/Negotiate authentication, and a shift from Azure-hosted to Cloudflare-backed C2 infrastructure to complicate attribution.
Conf:medium
Showing defanged values
- domainaecert[.]orgC2 host embedded in ArcBridge configuration block
- domainbuisness-centeral-transportation[.]comMirage Kitten-associated infrastructure domain
- domainbusiness-deegital[.]azurewebsites[.]netAzure-hosted C2 infrastructure domain
- domainbusinessdeegital[.]azurewebsites[.]netAzure-hosted C2 infrastructure domain
- domainBusiness-deegital[.]comMirage Kitten-associated infrastructure domain
- domainbusinessmixture[.]comC2 domain used by a BridgeHead variant communicating over WSS on port 443
- domainbusiness-startup[.]azurewebsites[.]netAzure-hosted C2 infrastructure domain
- domainbusinessstartup[.]azurewebsites[.]netAzure-hosted C2 infrastructure domain
- domainglobal-reds[.]comMirage Kitten-associated infrastructure domain
- domainhealthcarezoom-centeral[.]azurewebsites[.]netAzure-hosted C2 infrastructure domain
- domainhealthcarezoomcenteral[.]azurewebsites[.]netAzure-hosted C2 infrastructure domain
- domainhealthcarezoomcenteral[.]orgMirage Kitten-associated infrastructure domain
- domainmaadinglobal[.]comMirage Kitten-associated infrastructure domain
- domainneexportfolio[.]azurewebsites[.]netAzure-hosted C2 infrastructure domain
- domainneexportfolio[.]comMirage Kitten-associated infrastructure domain
- domainneexportfolio[.]eastus[.]cloudapp[.]azure[.]comAzure cloud app C2 infrastructure domain
- domainrealhealthshop[.]comPrimary C2 domain for NightLedger backdoor, contacted via HTTPS GET requests
- domainsmartconnect[.]azurewebsites[.]netC2 host for BridgeHead WebSocket tunneler, used for SOCKS5 relay establishment
- domainthehealth-life[.]comMirage Kitten-associated infrastructure domain
- domaintjconsultingservices[.]comFallback C2 domain for NightLedger backdoor
- domaintoadreport[.]azurewebsites[.]netAzure-hosted C2 infrastructure domain
- ip172[.]86[.]98[.]113IP address associated with Mirage Kitten infrastructure
- md542f847597109da2a220391bb09d00676ArcBridge WebSocket tunneling tool
- md55fa15ef96808ea82f0a6176f0bb4b386ArcBridge WebSocket tunneling tool
- md56038d42af0affd1fb263f470c0956f6bBridgeHead WebSocket tunneling tool - unbcl.dll
- md5a239e655709a2518dd0b7bdbed163679NightLedger backdoor sample masquerading as SspiCli.dll
- md5ae628efa305387b633dce82f9364875bBridgeHead WebSocket tunneling tool - unbcl.dll
- md5afb1c1583606599c7272cfb33cc6f498ArcBridge WebSocket tunneling tool
- md5c832ecd135781b11f59e3fffb3d2b6acBridgeHead variant communicating with businessmixture.com over WSS on port 443
- md5c90f0efadbf322e5eb1c4103a38c30e6BridgeHead WebSocket tunneling tool - libwinpthread-1.dll
- md5d09b14a2fe01c7363ecc56f5d046162cBridgeHead WebSocket tunneling tool - IPHLPAPI.dll
- md5f7d36cc5904a53252d2bb3d21615134fBridgeHead WebSocket tunneling tool - libwinpthread-1.dll
- mutexA8215357-F99A-44FE-BC65-D8F0434B0C03Mutex created by NightLedger backdoor to enforce single-instance execution
- mutexF56E68DA-4A89-46B4-9AC8-7290A7651000Mutex created by ArcBridge tunneler to enforce single-instance execution
Detection / HunterAnthropic
What Happened
A cyber-espionage group known as Mirage Kitten has been caught using new hacking tools against organizations in the Middle East and Africa, especially in aerospace, aviation, defense, and telecom sectors. The tools let attackers secretly control infected computers, take screenshots, steal files, and tunnel their traffic through a victim's network so it looks like it's coming from inside the organization. Victims identified so far are in Egypt, Jordan, Tanzania, Pakistan, Ethiopia, and Burkina Faso, though the exact way victims were first compromised (likely fake job offer emails or video-call links) wasn't fully confirmed for all cases. This matters because the tools are new, hard to detect, and designed to blend into legitimate network traffic and proxy servers. Organizations in these sectors and regions should review network traffic for unusual outbound connections and unexpected DLL files, and treat unsolicited recruitment or videoconferencing links with caution before opening any attachments.
Key Takeaways
- Mirage Kitten (aka UNC1549, Smoke Sandstorm, Nimbus Manticore) deployed a previously undocumented toolset including the NightLedger backdoor and two WebSocket tunnelers, ArcBridge and BridgeHead.
- NightLedger masquerades as SspiCli.dll to abuse DLL search-order hijacking via the legitimate AppVShNotify.exe binary, communicating over HTTPS with hardcoded endpoints and a custom delimiter-based protocol.
- BridgeHead operates as a full SOCKS5 tunneling proxy over WebSocket, includes enterprise proxy traversal logic (handling HTTP 407/Negotiate/NTLM), and restricts execution to specific usernames to evade sandbox/analysis environments.
- The group is shifting from Azure subdomain-style C2 infrastructure toward Cloudflare-backed domains, likely to complicate attribution while retaining resilient C2.
- Victims span Egypt, Jordan, Tanzania, Pakistan (aviation), Ethiopia (telecom), and Burkina Faso (financial sector), consistent with the group's aerospace, aviation, defense, and telecom targeting focus.
Affected Systems
- Windows systems in aerospace, aviation, defense, and telecommunications organizations
- Government and SMB environments in Jordan and Tanzania
- Financial-sector entities in Burkina Faso
- Telecommunications companies in Ethiopia
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Targeted spear-phishing with recruitment-themed lures and lookalike videoconferencing pages redirecting victims to malicious archives on file-sharing services (initial vector unclear for most samples analyzed)
- Persistence/Defense Evasion: NightLedger deployed as a malicious SspiCli.dll to exploit DLL search-order hijacking via legitimate AppVShNotify.exe/RPCRT4.dll delay-loading behavior
- Command and Control: NightLedger periodically beacons over HTTPS to hardcoded endpoints, tokenizing responses with a custom delimiter to drive command execution
- Lateral/Covert Access: BridgeHead and ArcBridge establish WebSocket-based SOCKS5 tunnels, using username-substring checks to restrict execution to specific target machines and evade analysis environments
- Proxy Evasion: BridgeHead negotiates corporate proxy authentication (Negotiate/NTLM) using SSO context to traverse enterprise proxy environments
- Collection/Exfiltration: NightLedger performs reconnaissance, screenshot capture, file operations, and exfiltrates data via HTTP POST to C2 endpoints
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not include YARA, Sigma, Snort/Suricata, or query-language detection rules. It states additional IOCs are available exclusively to customers of Kaspersky's Threat Intelligence Reporting service.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | DLL search-order hijacking, mutex creation, and process/file operations performed by NightLedger and BridgeHead would be visible to EDR tools monitoring module loads, process creation, and file writes, but the malware's masquerading as legitimate system DLLs (SspiCli.dll, libwinpthread-1.dll, IPHLPAPI.dll) could evade signature-based detection. |
| Network Visibility | Medium | C2 traffic uses HTTPS/WSS on standard ports (443) and mimics legitimate WebSocket upgrade handshakes, which would blend with normal traffic unless TLS inspection or domain/URI-pattern-based detection is in place. |
| Detection Difficulty | Hard | The malware uses legitimate-looking DLL names, DLL search-order hijacking against a trusted binary, standard HTTPS/WSS protocols, and per-target username-based execution gating, making both static and behavioral detection challenging without specific IOC or behavioral rule coverage. |
Required Log Sources
- EDR process creation and module load logs
- DLL load order / image load telemetry
- DNS query logs
- Proxy/firewall logs with TLS SNI or URI visibility
- Windows Event Logs (process creation, Sysmon Event ID 7 - image load, Event ID 1 - process creation, Event ID 3 - network connection)
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Look for a DLL named identically to a legitimate system DLL (e.g., SspiCli.dll) being loaded from a non-standard directory alongside a legitimate binary such as AppVShNotify.exe. | Sysmon Event ID 7 (image load), process/module load logs, file creation events | Persistence / Defense Evasion | Low - legitimate SspiCli.dll should only load from System32; loads from user-writable or application directories are anomalous. |
| Identify outbound HTTPS connections to unusual URI paths consisting of random alphanumeric strings (e.g., /edfcvfgbhnjmkqwasderfgg) that don't match typical web application patterns. | Proxy/firewall logs with URL visibility, network traffic metadata | Command and Control | Medium - some legitimate applications use randomized API endpoints, requiring correlation with other indicators. |
| Hunt for WebSocket upgrade requests (Upgrade: websocket) originating from non-browser processes or unusual endpoint binaries to Azure-hosted or newly registered domains. | Network traffic inspection, EDR network connection logs correlated with process ancestry | Command and Control / Lateral Movement | Medium - legitimate applications also use WebSocket, so process context is critical to reduce false positives. |
| Search for processes creating UUID-formatted mutex objects that do not correspond to known legitimate software. | EDR mutex/object creation telemetry (if supported), Sysmon extensions | Execution / Defense Evasion | Medium - some legitimate software also uses UUID-style mutexes, requiring additional context. |
| Monitor for collection of C:\Windows\debug\NetSetup.log paired with process enumeration activity shortly afterward, which may indicate reconnaissance staging for exfiltration. | File access/read logs, EDR file access telemetry, process creation logs | Collection / Discovery | Low - this specific log is rarely accessed outside of domain join/unjoin operations. |
Control Gaps
- Signature-based antivirus alone is unlikely to catch DLL search-order hijacking using renamed/masquerading legitimate-named DLLs
- Standard perimeter firewalls without TLS inspection cannot distinguish malicious WebSocket/HTTPS tunneling from legitimate encrypted traffic
- Username-based execution gating means sandbox/dynamic analysis environments may not trigger malicious behavior, reducing detection in automated malware analysis pipelines
Key Behavioral Indicators
- A DLL sharing a legitimate system DLL name (e.g., SspiCli.dll, libwinpthread-1.dll, IPHLPAPI.dll) loading from a non-System32 or unusual application directory
- Process ancestry showing a trusted binary (e.g., AppVShNotify.exe) loading a co-located non-standard DLL
- Outbound HTTPS connections with long randomized alphanumeric URI paths to newly observed domains
- WebSocket upgrade traffic from unexpected host processes to Azure *.azurewebsites.net or cloudapp.azure.com subdomains
- Repeated GetUserNameA calls followed by string comparison logic prior to any network activity in a binary
False Positive Assessment
Medium - Behavioral hunting hypotheses around DLL naming, WebSocket traffic, and mutex creation could produce false positives without correlation to specific IOCs or process context, since legitimate software also uses similar mechanisms (WebSocket, UUID mutexes, proxy authentication).
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting: search endpoints for the file hashes, mutex names, and domains listed in this report, prioritizing aerospace, aviation, defense, and telecom environments in the Middle East and Africa.
- If your EDR supports it, hunt for and isolate hosts where a DLL matching a legitimate name (SspiCli.dll, libwinpthread-1.dll, IPHLPAPI.dll) is loading from a non-standard directory.
- Consider blocking or monitoring outbound connections to the domains and IP listed in the priority IOCs at your network egress points, where feasible.
Infrastructure Hardening
- Evaluate implementing application allow-listing or code integrity policies to restrict DLL loading from non-standard paths for critical system binaries such as AppVShNotify.exe.
- Consider deploying TLS inspection or SNI-based filtering at network egress points to improve visibility into HTTPS/WSS tunneling traffic.
- Where applicable, review and restrict outbound access to Azure App Service (*.azurewebsites.net) domains that are not part of approved business use cases.
- Consider network segmentation to limit lateral tunneling capability from compromised endpoints into sensitive internal segments.
User Protection
- If supported by your EDR/AV tooling, deploy behavioral detection rules focused on DLL search-order hijacking patterns and unusual mutex creation.
- Consider enabling enhanced logging (e.g., Sysmon) for image load events (Event ID 7) and process creation (Event ID 1) on endpoints in targeted sectors.
- Evaluate restricting execution of unsigned or newly-written DLLs in user-writable directories such as %LocalAppData%.
Security Awareness
- Incorporate awareness training on recruitment-themed phishing lures and fake videoconferencing invitations, especially for staff in aerospace, aviation, defense, and telecom roles.
- Consider advising employees to verify unsolicited job offers or interview requests through official channels before opening attachments or following links.
- Review policies around downloading and opening archives from third-party file-sharing services referenced in unsolicited communications.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping14 techniques
Tactic
Initial Access
Tactic
Discovery
Tactic
Collection
Tactic
Command and Control
Tactic
Exfiltration
Additional IOCs
- Domains:
global-reds[.]com- Mirage Kitten-associated infrastructure domainmaadinglobal[.]com- Mirage Kitten-associated infrastructure domainBusiness-deegital[.]com- Mirage Kitten-associated infrastructure domainbusiness-deegital[.]azurewebsites[.]net- Azure-hosted C2 infrastructure domainbusinessdeegital[.]azurewebsites[.]net- Azure-hosted C2 infrastructure domainneexportfolio[.]azurewebsites[.]net- Azure-hosted C2 infrastructure domainneexportfolio[.]com- Mirage Kitten-associated infrastructure domainneexportfolio[.]eastus[.]cloudapp[.]azure[.]com- Azure cloud app C2 infrastructure domainthehealth-life[.]com- Mirage Kitten-associated infrastructure domainbuisness-centeral-transportation[.]com- Mirage Kitten-associated infrastructure domainhealthcarezoom-centeral[.]azurewebsites[.]net- Azure-hosted C2 infrastructure domainhealthcarezoomcenteral[.]azurewebsites[.]net- Azure-hosted C2 infrastructure domainhealthcarezoomcenteral[.]org- Mirage Kitten-associated infrastructure domaintoadreport[.]azurewebsites[.]net- Azure-hosted C2 infrastructure domainbusiness-startup[.]azurewebsites[.]net- Azure-hosted C2 infrastructure domainbusinessstartup[.]azurewebsites[.]net- Azure-hosted C2 infrastructure domain
- File Hashes:
A239E655709A2518DD0B7BDBED163679(MD5) - NightLedger backdoor - sspicli.dll5FA15EF96808EA82F0A6176F0BB4B386(MD5) - ArcBridge WebSocket tunneling tool42F847597109DA2A220391BB09D00676(MD5) - ArcBridge WebSocket tunneling toolAFB1C1583606599C7272CFB33CC6F498(MD5) - ArcBridge WebSocket tunneling tool6038D42AF0AFFD1FB263F470C0956F6B(MD5) - BridgeHead WebSocket tunneling tool - unbcl.dllAE628EFA305387B633DCE82F9364875B(MD5) - BridgeHead WebSocket tunneling tool - unbcl.dllF7D36CC5904A53252D2BB3D21615134F(MD5) - BridgeHead WebSocket tunneling tool - libwinpthread-1.dllC90F0EFADBF322E5EB1C4103A38C30E6(MD5) - BridgeHead WebSocket tunneling tool - libwinpthread-1.dllD09B14A2FE01C7363ECC56F5D046162C(MD5) - BridgeHead WebSocket tunneling tool - IPHLPAPI.dllC832ECD135781B11F59E3FFFB3D2B6AC(MD5) - BridgeHead variant communicating with businessmixture.com over WSS
- File Paths:
%LocalAppData%\Microsoft\VisualStudio\unbcl.dll- BridgeHead tunneler deployment location on Egypt-based victim machineC:\program files (x86)\univpn\promote\libwinpthread-1.dll- BridgeHead tunneler deployment location on Pakistan-based victim machineSspiCli.dll- Malicious DLL used by NightLedger to perform DLL search-order hijacking against AppVShNotify.exe
Related
Stay currentSubscribe via RSS