Kaspersky’s latest reporting on Mirage Kitten shows a familiar espionage pattern getting sharper: tailored social engineering, Windows DLL search-order hijacking, and tunneling malware built to survive inside enterprise proxy environments.

The group — also tracked as UNC1549, Smoke Sandstorm, and Nimbus Manticore — is tied to Iran-linked cyber-espionage activity. According to Kaspersky, recent operations targeted aerospace, aviation, defense, telecommunications, government, and financial-sector environments across the Middle East and Africa. The new toolset includes a Windows backdoor called NightLedger and two WebSocket-based tunnelers, BridgeHead and ArcBridge.

What changed

The important part is not just “new malware.” It is the operational design.

  • NightLedger masquerades as a Windows DLL and supports reconnaissance, process execution, file operations, screenshot capture, process listing, and file upload/download functions.
  • BridgeHead acts as a SOCKS5-style tunnel through a victim host, allowing operator traffic to appear as if it originates from inside the compromised environment.
  • ArcBridge provides another operator-controlled WebSocket tunneling capability for target access and DNS resolution.
  • The tunneling malware includes logic for corporate proxy traversal, including handling proxy authentication flows that are common in managed enterprise networks.
  • Some samples appear tailored to specific victim machines, including username checks that silently exit if the expected target context is not present.

That combination matters because it moves the defender’s problem from “find a malicious executable” to “identify an authenticated internal system quietly acting as a relay point.”

Why SMBs and government contractors should care

Mirage Kitten’s known targeting is not random consumer crime. The sectors in scope — defense, aviation, telecom, government, and adjacent suppliers — overlap heavily with the ecosystems small businesses and subcontractors support.

For a government contractor, the risk is not limited to direct compromise of classified or controlled environments. A smaller partner can be valuable because it holds credentials, project context, bid information, engineering data, contact lists, VPN access, or trusted communication paths into larger organizations.

The WebSocket tunneling angle is especially relevant. Many organizations allow outbound HTTPS and WebSocket traffic by default because blocking it outright can break SaaS tools. An attacker who can blend tunnel traffic into normal encrypted outbound flows can maintain access without relying on noisy inbound infrastructure.

Defensive takeaways

1. Watch for internal relay behavior, not just malware names

Hunt for endpoints initiating unusual long-lived outbound WebSocket or HTTPS sessions, especially to newly registered domains, unusual cloud-hosting endpoints, or infrastructure that does not match the user’s role. Pay attention to workstations or servers that suddenly begin talking to destinations outside their normal business pattern.

2. Treat proxy authentication as a detection surface

BridgeHead’s proxy-aware behavior is a reminder that enterprise proxy logs can be valuable telemetry. Look for repeated HTTP 407 proxy-authentication negotiation patterns, unusual user agents, and endpoints that begin using proxy paths they have never used before.

3. Baseline DLL loading around legitimate Microsoft and third-party binaries

NightLedger’s DLL hijacking approach means defenders should monitor suspicious DLL placement near trusted binaries, unexpected module loads from user-writable directories, and mismatches between signed parent binaries and unsigned or recently created DLLs.

4. Do not ignore screenshot and NetSetup.log collection

Screenshot capture and Windows network-setup log collection are practical reconnaissance steps. In an incident, those behaviors can indicate the actor is mapping user context, domain joins, host relationships, and operational workflows — not just staging commodity malware.

5. Build egress rules around business purpose

Outbound allow-by-default is convenient, but it gives tunnelers room to work. Prioritize egress filtering for servers, admin workstations, build systems, finance systems, and remote-access infrastructure. Those systems should have narrower external communication patterns than ordinary user browsing devices.

Bulwark Black assessment

Mirage Kitten’s new tools show how modern espionage groups are adapting to managed environments. They are not just dropping backdoors and hoping for the best; they are building tooling that understands proxy authentication, target-specific execution, and internal network tunneling.

For small and mid-sized organizations, the practical move is to tighten visibility around outbound encrypted traffic, DLL search-order abuse, and remote access patterns before an incident. If your environment supports government, defense, aviation, telecom, energy, or critical infrastructure customers, treat this as another reason to review endpoint telemetry, proxy logs, and egress controls now — not after a partner asks for evidence during an incident.

Source: Kaspersky Securelist — Mirage Kitten targets Middle East and Africa region with new malware