Mirage Kitten Uses NightLedger and WebSocket Tunnelers in Espionage Campaign
Summary
Kaspersky researchers attribute NightLedger, ArcBridge and BridgeHead to Mirage Kitten, reporting their use in espionage targeting aerospace, aviation, defense and telecom organizations across the Middle East, Europe and Africa. Initial access remained unclear for most
Key points
- Researchers attribute the malware set to Mirage Kitten based on code and behavioral similarities, and observed BridgeHead deployments in Egypt and a Pakistan-based aerospace and aviation environment.
- Spear-phishing lures included recruitment-themed content and lookalike videoconferencing pages that redirected targets to malicious archives; initial access remained unclear for most observed samples.
- NightLedger is a Windows backdoor that can execute processes, discover files and processes, capture screenshots, transfer files, and collect NetSetup.log.
- NightLedger masquerades as SspiCli.dll and appears designed for DLL search-order hijacking through a legitimate AppVShNotify.exe binary; it communicates with command-and-control servers over HTTPS.
- BridgeHead and ArcBridge are WebSocket tunnelers that provide operator-controlled relay access. BridgeHead supports SOCKS5-style TCP tunneling and handles corporate proxy authentication using Negotiate or NTLM.
- BridgeHead checks the local username before activating, while ArcBridge supports operator commands to open tunnels and resolve hostnames or addresses.
- Telemetry identified victims in Egypt, Jordan, Tanzania, Pakistan, Ethiopia and Burkina Faso, across government, aviation, telecom, financial and other sectors.
Article Details
- Attack Vectors
- Targeted spear-phishing with recruitment-themed lures impersonating trusted brands and hiring platforms.
- Lookalike videoconferencing pages redirected victims to malicious archives hosted on third-party file-sharing services.
- NightLedger used DLL search-order hijacking via a malicious SspiCli.dll alongside AppVShNotify.exe.
- BridgeHead and ArcBridge provided WebSocket-based tunneling; BridgeHead handled corporate proxy authentication and relayed operator traffic through victim machines.
- Defensive Notes
- Monitor for unexpected SspiCli.dll loading alongside AppVShNotify.exe and for NightLedger's reported HTTPS beaconing and HTTP POST activity.
- Review proxy logs for unusual WebSocket connections, repeated HTTP 407 responses, and Windows-integrated proxy authentication associated with tunneling activity.
- Hunt for the reported NightLedger and BridgeHead mutexes, deployment filenames, and paths, including A8215357-F99A-44FE-BC65-D8F0434B0C03 and F56E68DA-4A89-46B4-9AC8-7290A7651000.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | aecert[.]org | C2 host embedded in ArcBridge's configuration block. |
| DOMAIN | buisness-centeral-transportation[.]com | Listed among the article's campaign infrastructure indicators. |
| DOMAIN | business-deegital[.]azurewebsites[.]net | Listed among the article's campaign infrastructure indicators. |
| DOMAIN | business-startup[.]azurewebsites[.]net | Listed among the article's campaign infrastructure indicators. |
| DOMAIN | businessdeegital[.]azurewebsites[.]net | Listed among the article's campaign infrastructure indicators. |
| DOMAIN | businessmixture[.]com | Domain used by a BridgeHead-related variant for WSS communications. |
| DOMAIN | businessstartup[.]azurewebsites[.]net | Listed among the article's campaign infrastructure indicators. |
| DOMAIN | global-reds[.]com | Listed among the article's campaign infrastructure indicators. |
| DOMAIN | healthcarezoom-centeral[.]azurewebsites[.]net | Listed among the article's campaign infrastructure indicators. |
| DOMAIN | healthcarezoomcenteral[.]azurewebsites[.]net | Listed among the article's campaign infrastructure indicators. |
| DOMAIN | healthcarezoomcenteral[.]org | Listed among the article's campaign infrastructure indicators. |
| DOMAIN | neexportfolio[.]azurewebsites[.]net | Listed among the article's campaign infrastructure indicators. |
| DOMAIN | neexportfolio[.]com | Listed among the article's campaign infrastructure indicators. |
| DOMAIN | neexportfolio[.]eastus[.]cloudapp[.]azure[.]com | Specific hostname listed among the article's campaign infrastructure indicators. |
| DOMAIN | realhealthshop[.]com | NightLedger C2 domain used for periodic HTTPS requests. |
| DOMAIN | smartconnect[.]azurewebsites[.]net | BridgeHead WebSocket C2 host identified in the article. |
| DOMAIN | thehealth-life[.]com | Listed among the article's campaign infrastructure indicators. |
| DOMAIN | tjconsultingservices[.]com | NightLedger fallback C2 domain. |
| DOMAIN | toadreport[.]azurewebsites[.]net | Listed among the article's campaign infrastructure indicators. |
| IPV4 | 172[.]86[.]98[.]113 | IP address listed as associated campaign infrastructure. |
| MD5 | 42f847597109da2a220391bb09d00676 | Hash listed for an ArcBridge WebSocket tunneling tool sample. |
| MD5 | 5fa15ef96808ea82f0a6176f0bb4b386 | Hash listed for an ArcBridge WebSocket tunneling tool sample. |
| MD5 | 6038d42af0affd1fb263f470c0956f6b | Hash listed for a BridgeHead WebSocket tunneling tool sample. |
| MD5 | a239e655709a2518dd0b7bdbed163679 | Hash listed for the NightLedger backdoor sample. |
| MD5 | ae628efa305387b633dce82f9364875b | Hash listed for an additional BridgeHead-related sample. |
| MD5 | afb1c1583606599c7272cfb33cc6f498 | Hash listed for an ArcBridge WebSocket tunneling tool sample. |
| MD5 | c832ecd135781b11f59e3fffb3d2b6ac | Hash of a BridgeHead-related variant described as communicating with businessmixture.com/blog over WSS. |
| MD5 | c90f0efadbf322e5eb1c4103a38c30e6 | Hash listed for a BridgeHead sample stored as libwinpthread-1.dll. |
| MD5 | d09b14a2fe01c7363ecc56f5d046162c | Hash listed for a BridgeHead sample stored as IPHLPAPI.dll. |
| MD5 | f7d36cc5904a53252d2bb3d21615134f | Hash listed for a BridgeHead sample stored as libwinpthread-1.dll. |
MITRE ATT&CK
T1005 · Data from Local SystemNightLedger can collect the local C:WindowsdebugNetSetup.log file.T1036 · MasqueradingNightLedger masquerades as SspiCli.dll, and BridgeHead samples are stored under filenames including unbcl.dll and libwinpthread-1.dll.T1041 · Exfiltration Over C2 ChannelNightLedger uploads files and sends command output to its C2 over the C2 channel.T1057 · Process DiscoveryNightLedger can list running processes and collect process-list output.T1071.001 · Web ProtocolsNightLedger uses HTTPS GET requests to contact C2 and HTTP POST requests to return command output and uploaded files.T1083 · File and Directory DiscoveryNightLedger can list directories and enumerate logical drives.T1090.002 · External ProxyBridgeHead handles HTTP 407 proxy responses and retries connections using Windows-integrated proxy authentication.T1105 · Ingress Tool TransferNightLedger supports downloading files to the infected system from its C2.T1113 · Screen CaptureNightLedger supports taking screenshots of the infected system.T1566.001 · Spearphishing AttachmentThe article reports targeted spear-phishing with recruitment-themed lures and lookalike videoconferencing pages that led victims to malicious archives.T1574.001 · DLLNightLedger masquerades as SspiCli.dll and is loaded through DLL search-order behavior involving AppVShNotify.exe.
Threat Actors
Mirage KittenThe article attributes the targeted cyber-espionage activity and development and use of NightLedger, ArcBridge, and BridgeHead to Mirage Kitten.Nimbus ManticoreThe article identifies Smoke Sandstorm as another tracking name for Mirage Kitten, which it attributes to the reported cyber-espionage activity.UNC1549The article identifies UNC1549 as another tracking name for Mirage Kitten, which it attributes to the reported cyber-espionage activity.
Malware
ArcBridgeSandstorm, and Nimbus Manticore) deployed custom malware including the NightLedger backdoor and the ArcBridge and BridgeHead WebSocket tunnelers to conduct targeted espionage against aerospace, aviation, defense,BridgeHeadand Nimbus Manticore) deployed custom malware including the NightLedger backdoor and the ArcBridge and BridgeHead WebSocket tunnelers to conduct targeted espionage against aerospace, aviation, defense, and telecomLIGHTRAILThis aligns with previous public reporting, which documented the group’s use of the LIGHTRAIL and POLLBLEND tunnelers.MiniFastseen in the backdoor we track internally as Retrograde, which overlaps with tooling publicly reported as MiniFast/MiniUpdate, attributed to the same APT group.NightLedger(also tracked as UNC1549, Smoke Sandstorm, and Nimbus Manticore) deployed custom malware including the NightLedger backdoor and the ArcBridge and BridgeHead WebSocket tunnelers to conduct targeted espionage againstPOLLBLENDThis aligns with previous public reporting, which documented the group’s use of the LIGHTRAIL and POLLBLEND tunnelers.Retrograde/MiniFastclosely mirrors the enterprise proxy traversal logic seen in the backdoor we track internally as Retrograde, which overlaps with tooling publicly reported as MiniFast/MiniUpdate, attributed to the same APT group.TWOSTROKE[T1027] Obfuscated Files or Information – NightLedger tokenizes custom C2 payloads and TWOSTROKE uses hex-encoded responses (‘tokenizes the payload’ and ‘hex-encoded’).
Tools
ArcBridgeSandstorm, and Nimbus Manticore) deployed custom malware including the NightLedger backdoor and the ArcBridge and BridgeHead WebSocket tunnelers to conduct targeted espionage against aerospace, aviation, defense,BridgeHeadand Nimbus Manticore) deployed custom malware including the NightLedger backdoor and the ArcBridge and BridgeHead WebSocket tunnelers to conduct targeted espionage against aerospace, aviation, defense, and telecom
Countries
Burkina FasoVictims were observed across Egypt, Jordan, Tanzania, Pakistan, Ethiopia, and Burkina Faso, with activity affecting government, SMB, aviation, telecom, and financial sectors.EgyptVictims were observed across Egypt, Jordan, Tanzania, Pakistan, Ethiopia, and Burkina Faso, with activity affecting government, SMB, aviation, telecom, and financial sectors.EthiopiaVictims were observed across Egypt, Jordan, Tanzania, Pakistan, Ethiopia, and Burkina Faso, with activity affecting government, SMB, aviation, telecom, and financial sectors.JordanVictims were observed across Egypt, Jordan, Tanzania, Pakistan, Ethiopia, and Burkina Faso, with activity affecting government, SMB, aviation, telecom, and financial sectors.PakistanVictims were observed across Egypt, Jordan, Tanzania, Pakistan, Ethiopia, and Burkina Faso, with activity affecting government, SMB, aviation, telecom, and financial sectors.TanzaniaVictims were observed across Egypt, Jordan, Tanzania, Pakistan, Ethiopia, and Burkina Faso, with activity affecting government, SMB, aviation, telecom, and financial sectors.
Industries
Aerospacebackdoor and the ArcBridge and BridgeHead WebSocket tunnelers to conduct targeted espionage against aerospace, aviation, defense, and telecom victims in the Middle East, Europe, and Africa.Aviationand the ArcBridge and BridgeHead WebSocket tunnelers to conduct targeted espionage against aerospace, aviation, defense, and telecom victims in the Middle East, Europe, and Africa.DefenseArcBridge and BridgeHead WebSocket tunnelers to conduct targeted espionage against aerospace, aviation, defense, and telecom victims in the Middle East, Europe, and Africa.GovernmentVictims were observed across Egypt, Jordan, Tanzania, Pakistan, Ethiopia, and Burkina Faso, with activity affecting government, SMB, aviation, telecom, and financial sectors.TelecommunicationsMirage Kitten is a long-running APT group focused on cyber-espionage against aerospace, aviation, defense, and telecommunications targets.