Summary
Mirage Kitten, an Iranian state-backed espionage group also tracked as UNC1549, Smoke Sandstorm, and Nimbus Manticore, has deployed three previously undocumented malware families: the NightLedger backdoor and two WebSocket-based tunneling tools, BridgeHead and ArcBridge, against targets across the Middle East, Africa, and South Asia. The group relies on highly tailored spear-phishing, using recruitment-themed lures and fake video conferencing pages, to gain initial access before deploying NightLedger for reconnaissance and command execution and BridgeHead/ArcBridge for covert operator-controlled network tunneling. Targeted industries include aerospace, aviation, defense, telecommunications, government, financial services, and small and medium-sized businesses, with Windows environments as the primary target platform.
Attack Details
Three previously undocumented malware families
Mirage Kitten, an espionage-focused APT operating against the Middle East and Africa, has been observed deploying three previously undocumented malware families. NightLedger is a Windows backdoor that masquerades as SspiCli.dll and is loaded through DLL search-order hijacking against the legitimate AppVShNotify.exe binary, providing reconnaissance, command execution, file operations, process discovery, screenshot capture, and collection of the Windows NetSetup.log diagnostic file over an HTTPS command-and-control channel.
Per-target tailored WebSocket tunnelers
BridgeHead and ArcBridge are custom WebSocket-based tunnelers that convert compromised hosts into operator-controlled relay nodes, with BridgeHead functioning as a full SOCKS5 tunnel proxy capable of traversing enterprise proxies using the logged-on user's Windows single sign-on context. BridgeHead restricts execution to specific victim machines by validating a hardcoded substring against the local Windows username, confirming per-target tailoring of each binary. BridgeHead deployments followed targeted spear-phishing that used recruitment-themed lures and lookalike video conferencing pages to deliver malicious archives from third-party file-sharing services.
Spear-phishing initial access in Egypt and Pakistan
The initial access vector remains undetermined for most of the malware samples observed in this activity. However, BridgeHead was observed being deployed during post-exploitation activity in victim environments in Egypt and at a Pakistan-based aerospace and aviation organization. The intrusions followed highly targeted spear-phishing activity consistent with tradecraft Mirage Kitten has used previously, employing recruitment-themed lures that impersonate trusted brands and hiring platforms alongside lookalike video conferencing pages that redirect victims to malicious archives hosted on third-party file-sharing services.
Reconnaissance, tunneling, and data exfiltration
NightLedger provides a broad post-compromise command set: user, host, and network reconnaissance, directory and logical-drive enumeration, process listing, screenshot capture, and retrieval of the Windows NetSetup.log diagnostic file with process-list output. Command output and stolen files return to the C2 over HTTPS via separate POST endpoints, and operators can deliver or delete files on demand. BridgeHead and ArcBridge hold open a long-lived channel through which server-side tooling reaches the environment, making each victim a relay for traffic that appears to originate inside its own network, and data can still exfiltrate through those tunnels.
Recommendations
Detect the hardcoded mutex names
Deploy endpoint detection for creation of the mutexes A8215357-F99A-44FE-BC65-D8F0434B0C03 and F56E68DA-4A89-46B4-9AC8-7290A7651000, which are high-fidelity, low-noise indicators because both are fixed UUID-style values used for single-instance enforcement.
Inspect unexpected DLLs in application data directories
Audit for DLL files written to user-writable application paths such as %LocalAppData%\Microsoft\VisualStudio and third-party VPN client directories, since BridgeHead was recovered as unbcl.dll and libwinpthread-1.dll from precisely these locations under legitimate-looking names.
Monitor outbound WebSocket traffic
Baseline and alert on WebSocket upgrade requests to cloud-hosted endpoints, particularly HTTP 101 responses following requests to /connect on azurewebsites.net subdomains, and treat long-lived WSS sessions with regular thirty-second keepalives from non-browser processes as suspicious.
Monitor for WebSocket-based tunneling
Deploy detection logic for outbound WebSocket upgrade requests to unfamiliar Azure-hosted or Cloudflare-backed domains, particularly HTTP 101 Switching Protocol responses followed by sustained binary traffic consistent with SOCKS5 tunneling used by BridgeHead and ArcBridge.
Detect anomalous NetSetup.log access
Alert on unusual read access to C:\Windows\debug\NetSetup.log combined with process-listing activity, as this specific collection pattern is a distinguishing NightLedger behavior.
MITRE ATT&CK TTPs
Indicators of Compromise (IoCs)
| Type | Value |
|---|---|
| SHA256 | 24771d0a69e442b9493ab1406e0253be1acd31d83f593177fd736f7f6d629ed9 |
| MD5 | A239E655709A2518DD0B7BDBED163679, 5FA15EF96808EA82F0A6176F0BB4B386, 42F847597109DA2A220391BB09D00676, AFB1C1583606599C7272CFB33CC6F498, 6038D42AF0AFFD1FB263F470C0956F6B, AE628EFA305387B633DCE82F9364875B, F7D36CC5904A53252D2BB3D21615134F, C90F0EFADBF322E5EB1C4103A38C30E6, D09B14A2FE01C7363ECC56F5D046162C |
| Filename | sspicli.dll, unbcl.dll, libwinpthread-1.dll, IPHLPAPI.dll |
| Domains | smartconnect[.]azurewebsites[.]net, businessmixture[.]com, global-reds[.]com, maadinglobal[.]com, business-deegital[.]com, business-deegital[.]azurewebsites[.]net, businessdeegital[.]azurewebsites[.]net, neexportfolio[.]azurewebsites[.]net, neexportfolio[.]com, neexportfolio[.]eastus[.]cloudapp[.]azure[.]com, aecert[.]org, realhealthshop[.]com, tjconsultingservices[.]com, thehealth-life[.]com, buisness-centeral-transportation[.]com, healthcarezoom-centeral[.]azurewebsites[.]net, healthcarezoomcenteral[.]azurewebsites[.]net, healthcarezoomcenteral[.]org, toadreport[.]azurewebsites[.]net, business-startup[.]azurewebsites[.]net, businessstartup[.]azurewebsites[.]net |
| IPv4 | 172[.]86[.]98[.]113 |
| Mutex | A8215357-F99A-44FE-BC65-D8F0434B0C03, F56E68DA-4A89-46B4-9AC8-7290A7651000 |
| Implant ID | 4B8CC395-A26F-41F1-A1DC-8B993D9D41D2 |
References & Patch Links
The following source details Mirage Kitten's use of the NightLedger backdoor and the BridgeHead and ArcBridge tunneling tools.
What Next?
At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.
