Full Report
Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.
Analysis Summary
# Threat Actor: Mirage Kitten
## Attribution & Identity
* **Primary Name:** Mirage Kitten
* **Aliases:** UNC1549, Smoke Sandstorm (Microsoft), Nimbus Manticore (CrowdStrike).
* **Known Associations:** This actor is an Iran-linked group. It has historical overlaps with activities previously attributed to APT33, though it is currently tracked as a distinct entity.
## Activity Summary
Recent research by Kaspersky highlights a campaign focused on South Asian targets, notably involving the deployment of previously undocumented custom malware. This campaign demonstrates the actor's shift toward using specialized tunneling tools and backdoors to maintain persistence and facilitate lateral movement within high-value networks.
## Tactics, Techniques & Procedures
* **Spear Phishing:** Initial access via job-themed lures or industry-specific themes.
* **Lateral Movement:** Use of custom tunneling tools to bypass network segmentation.
* **Credential Harvesting:** Usage of legitimate tools and custom scripts to extract credentials from memory and browsers.
* **Persistence:** Establishing long-term access via custom backdoors and scheduled tasks.
* **MITRE ATT&CK Techniques:**
* **T1566.001:** Phishing: Spearphishing Attachment
* **T1059.003:** Command and Scripting Interpreter: Windows Command Shell
* **T1572:** Protocol Tunneling
* **T1071.001:** Application Layer Protocol: Web Protocols
## Targeting
* **Sectors:** Defense, Aerospace, Energy, and Government.
* **Geography:** Primarily South Asia (notably Middle Eastern interests within the region) and Israel.
* **Victims:** Not specifically named in the provided text, but generally identifies entities within the defense industrial base.
## Tools & Infrastructure
* **Malware Families:**
* **NightLedger:** A previously undocumented backdoor used for command execution and data exfiltration.
* **ArcBridge:** A custom tool used to manage communication between the victim and the C2.
* **BridgeHead:** A tunneling tool used for internal pivoting and data relay.
* **Infrastructure:**
* **C2 Domains:**
* microsoft-office-update\[.\]com
* cdn-edge-serv\[.\]com
* api-dev-stg\[.\]com
* **IP Addresses:**
* 194\[.\]147\[.\]142\[.\]196
* 5\[.\]199\[.\]133\[.\]182
## Implications
The discovery of NightLedger and the "Bridge" suite of tools indicates that Mirage Kitten is actively developing custom code to evade traditional signature-based detections. Their focus on tunneling reveals a strategic priority on maintaining long-term stealthy access to sensitive environments (espionage) rather than immediate disruption.
## Mitigations
* **Network Segmentation:** Restrict internal traffic to prevent the effectiveness of custom tunneling tools like BridgeHead.
* **Email Security:** Implement advanced threat protection to detect and detonate spear-phishing attachments.
* **Endpoint Monitoring:** Monitor for unusual parent-child process relationships (e.g., `cmd.exe` or `powershell.exe` spawned from web servers or office applications).
* **Credential Guard:** Enable Windows Defender Credential Guard to prevent the dumping of LSASS memory.