Summary
Mirage Kitten (aka Nimbus Manticore), an Iran-linked cyberespionage group active since at least 2022, is targeting aviation, aerospace, and FinTech specialists across the Middle East and Africa with recruitment-themed social engineering. Fake recruiters on LinkedIn and other job-search platforms deliver trojanized coding-challenge archives hosted on an Amazon S3 bucket that bundle malicious npm packages. Running the project executes the group’s first Node.js- and JavaScript-based cross-platform remote access trojans, NodeRabbit and PollCat, granting remote access, host reconnaissance, credential and artifact harvesting, and file exfiltration across Windows, Linux, and macOS, with command-and-control concealed behind Microsoft Azure Websites and Cloudflare-backed domains.
Attack Details
Finding #1
Mirage Kitten, an Iran-linked cyberespionage group (also tracked as Nimbus Manticore, UNC1549, Smoke Sandstorm, and Iranian Dream Job), is targeting aviation, aerospace, and FinTech specialists across the Middle East and Africa, with confirmed victims in Egypt, Ethiopia, and Afghanistan. The operation opens with fake recruiter personas on LinkedIn and other job platforms: posing as a talent acquisition specialist at a major technology company, the actor invites a software engineer to complete a “technical assessment” and pressures them to download and run a coding-challenge archive hosted on an Amazon S3 bucket.
Finding #2
The lure is engineered for both stealth and urgency. One archive, Front-Technical-Challenge.zip, held a TaskFlow app whose README demanded frontend fixes within three hours, banned AI assistants (which would have flagged the malicious import), and falsely declared server.js off-limits, the one file the attackers had altered. Its first line loaded a trojanized npm package (colorized_terminal or pretty-log, v2.1.0) bundled locally, which silently launched the implant as a detached background process.
Finding #3
That implant is NodeRabbit, the group’s first Node.js remote access trojan, running on Windows, Linux, and macOS. It fingerprints the host, guards against re-execution, and persists per OS while masquerading as Microsoft Edge Update or Intel Driver & Support Assistant. Across three variants it adds sandbox evasion, corporate-proxy tunneling, Outlook email harvesting, a fake “GitHub Copilot Helper” VS Code extension, and Git-hook injection, growing to 23 commands.
Finding #4
A parallel lure (RankChallenge-react) delivered PollCat, an obfuscated-JavaScript RAT gated behind an attacker-supplied, rapidly expiring six-digit OTP to force speed. PollCat runs regardless of OTP success, registers with its C2, and profiles the host, inventorying processes and hunting for 24 security-vendor directories. Both RATs beacon over HTTP(S) to Microsoft Azure Websites and Cloudflare-backed domains, sometimes embedding the victim’s own name in the subdomain to blend in; NodeRabbit encrypts traffic with AES-256-GCM. Attribution to Mirage Kitten is high-confidence, resting on strong structural overlaps with its earlier Retrograde/MiniFast backdoor.
Recommendations
Treat any coding challenge received through LinkedIn or a job platform as untrusted code and never run it on a production, domain-joined, or credential-bearing workstation. Require isolated, network-restricted VMs or containers, and flag lures that impose artificial urgency or forbid AI code review.
Ingest the Mirage Kitten hashes, C2 domains, URLs, filenames, and the MicrosoftEdgeUpdate Run-key indicator into EDR, SIEM, and firewall tooling, and alert on outbound connections to the listed Azure Websites and Cloudflare-backed domains, including subdomains embedding your organization’s name.
Sweep developer endpoints for the trojanized packages colorized_terminal and pretty-log pinned to version 2.1.0, and for any package loaded from a project-local node_modules directory never installed from the public registry, with particular attention to payloads under node_modules/.cache/.320697f1/.
Search every operating system for the MicrosoftEdgeUpdate Run key; scheduled tasks named IntelDriverSupportUpdate and NetSync_<username>; WSL-launched daily 10 AM tasks; @reboot and daily cron entries; and macOS LaunchAgents such as com.microsoft.edgeupdate.plist. Inspect VS Code for a fake “GitHub Copilot Helper” extension and review Git hooks for the injected marker # shepherd-persist.
MITRE ATT&CK TTPs
Indicators of Compromise (IoCs)
| Type | Value |
|---|---|
| MD5 | CBAAF0900A13F28E380F49ADECEC932C, 1EA83E4E4592B01E4ACAB63EB867BEE5, 366515822D5AC1CC500711EF57A2E32E, CF449F1992C2819E62AC44A0B06AC2E7, E95A4366686E3F786EA3C056FAB5B0DA, DE5AF16A3757EF700B01DC34D67079AE, BE086789568441D0D7E4679AEE51F566, E259C5EDF158AAC4CFE14F77DDD0B196, 291AC3ABE73C5158E59A437B75D5F0AA, 0962F56D7EC69F4F2A0162DCBE22116B, 795E053A990A1569FFDCB57F48F6D085, 810F8E3B88EB05F710C09552941D6F56 |
| Domains | oracle-challenge[.]s3[.]us-east-1[.]amazonaws[.]com, naturalapplication[.]azurewebsites[.]net, retaildemo[.]azurewebsites[.]net, tubitak[.]azurewebsites[.]net, rgbteller[.]azurewebsites[.]net, wslwebui[.]azurewebsites[.]net, plugplay[.]azurewebsites[.]net, crossdwm[.]azurewebsites[.]net, wdisystem[.]azurewebsites[.]net, wslmenus[.]azurewebsites[.]net, dnshnsdev[.]azurewebsites[.]net, hpjumpsrv[.]azurewebsites[.]net, storview[.]azurewebsites[.]net, healthcomfsdpower[.]com, visitfinancedentists[.]com, kyrasey-f8hfexa5cqamh7fk[.]westeurope-01[.]azurewebsites[.]net, greenyjsgfd[.]azurewebsites[.]net, helptellerbls[.]azurewebsites[.]net, timedrv[.]azurewebsites[.]net, userwellgtfs[.]azurewebsites[.]net, hecowime-aqdphyd4bbdef6es[.]westeurope-01[.]azurewebsites[.]net, msmanagementgrp[.]com, msmanagementgrpmedia[.]com, lifespotify[.]com, gamebarapp[.]azurewebsites[.]net, gamebarappinformation[.]azurewebsites[.]net, sahi-finance[.]com, healthful-hub[.]com, neumedicahealthcare[.]com, optimumhealthcredit[.]com, healthfullyrecipes[.]com, refreshhealthandwellness[.]com, healthvitalitycare[.]com, aceofspadesmanagement[.]com, glmediaagency[.]com, digimediaskill[.]com, healthyweightplan[.]com, mens-health-online[.]com |
| URLs | hxxps[:]//oracle-challenge[.]s3[.]us-east-1[.]amazonaws[.]com/Front-Technical-Challenge[.]zip, hxxps[:]//lifespotify[.]com/api/users/b879746e-fed9-4211-a6da-4d8223681267/otp/validate |
| Filenames | FrontEnd-Task.zip, Front-Technical-Challenge.zip, Task-FullStack.zip, fullstack-1536.zip, webapp76592.zip, webapp76531.zip, challenges-17831.zip, challenges-17832.zip, Project-1802.zip, Case-34234.zip, RankChallenge-react-6uJSX3-main.zip, colorized_terminal, pretty-log, msedge_update.js, nodew.exe, idriver_support.js, IntelDSA.exe, requireObject.js, launcher.vbs |
| Registry Key | HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdate |
References
- https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/
- https://www.hivepro.com/threat-advisory/mirage-kitten-marks-new-territory-across-the-middle-east-and-africa
What Next?
At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.
.svg)