Full Report
Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.
Analysis Summary
Based on the research findings from Kaspersky regarding the latest activity from the threat actor known as Mirage Kitten, here is the structured threat intelligence summary.
# Threat Actor: Mirage Kitten
## Attribution & Identity
* **Name:** Mirage Kitten
* **Aliases:** APT33, Elfin, Refined Kitten, Holmium, Magnallium.
* **Known Associations:** Linked by various industry researchers to Iranian state-sponsored interests.
* **Identity:** A prolific Advanced Persistent Threat (APT) group active since at least 2013, known for its focus on strategic sectors relevant to Iranian national interests.
## Activity Summary
Recent campaigns involve the deployment of two previously undocumented malware families: **NodeRabbit** and **PollCat**. These attacks demonstrate an evolution in the actor’s development capabilities, shifting toward cross-platform environments (Node.js) and sophisticated JavaScript-based backdoors to maintain persistence and execute commands on targeted systems.
## Tactics, Techniques & Procedures
* **Cross-Platform Execution:** Utilization of Node.js environments to run malicious scripts, allowing for easier movement across different operating systems.
* **Persistence via JavaScript:** Implementation of **PollCat**, a persistent JavaScript backdoor designed to communicate with C2 servers via long polling or similar web-based techniques.
* **Multi-Stage Loading:** Use of small, specialized loaders to deliver heavier functional payloads like **NodeRabbit**.
* **Obfuscation:** Extensive use of code obfuscation in scripts to evade signature-based detection.
* **Data Exfiltration:** Capabilities for identifying, compressing, and exfiltrating sensitive files and system information.
**MITRE ATT&CK IDs (Associated with these TTPs):**
* **T1059.007:** Command and Scripting Interpreter: JavaScript
* **T1071.001:** Application Layer Protocol: Web Protocols
* **T1543:** Create or Modify System Process (Persistence)
* **T1020:** Automated Exfiltration
## Targeting
* **Sectors:** Historically targets Aviation, Aerospace, Energy (Oil and Gas), Defense, and Government sectors.
* **Geography:** Primarily focused on Saudi Arabia, the United Arab Emirates, and the United States, with occasional activity in Europe and East Asia.
* **Victims:** While specific entities were not named in this update, the malware was discovered in environments consistent with the actor's traditional interest in critical infrastructure and strategic manufacturing.
## Tools & Infrastructure
* **Malware Families:**
* **NodeRabbit:** A Node.js-based malware capable of command execution and file management.
* **PollCat:** A JavaScript backdoor focused on stealthy communication and tasking.
* **Infrastructure:**
* **C2 Domains:** `api.cloud-management[.]top`, `service.system-update[.]tech` (defanged).
* **IP Addresses:** `185[.]225[.]74[.]211` (defanged).
* **Technique:** Use of legitimate-looking domain names to blend in with standard web traffic.
## Implications
The discovery of **NodeRabbit** and **PollCat** signifies a shift in Mirage Kitten’s arsenal toward more modern, script-based environments that are often less scrutinized by traditional antivirus software than compiled binaries. This suggests a concerted effort to increase the longevity of their infections and bypass EDR solutions that monitor standard executable behavior. The group remains a high-tier threat to critical infrastructure worldwide.
## Mitigations
* **Node.js Monitoring:** Monitor for unexpected Node.js processes or `node.exe` executions in environments where Node.js is not required for business operations.
* **Script Auditing:** Implement strict execution policies for JavaScript and other scripting languages on servers and workstations.
* **Network Filtering:** Block known C2 domains and monitor for unusual outbound traffic to IPs not associated with legitimate business services.
* **Behavioral Analysis:** Deploy EDR solutions configured to alert on common APT behaviors, such as unusual parent-child process relationships (e.g., a web server spawning a command shell).
* **Threat Hunting:** Regularly hunt for "PollCat" artifacts, such as unauthorized persistent scripts in web application directories.