Mirage Kitten’s operators are deploying a new Windows backdoor and multiple WebSocket-based tunnelers to maintain covert footholds and relay operator traffic through victim networks — a capability that directly threatens aerospace, aviation, defense and telecommunications organizations across the Middle East and Africa.
NightLedger: a backdoor built for persistence and reconnaissance
The group’s newly identified Windows implant, tracked as NightLedger, masquerades as SspiCli.dll and is designed for DLL search‑order hijacking against a legitimate AppVShNotify.exe binary. The malicious DLL creates the mutex A8215357-F99A-44FE-BC65-D8F0434B0C03 to enforce single-instance execution and exits if the mutex already exists. NightLedger periodically beacons to realhealthshop[.]com at the /edfcvfgbhnjmkqwasderfgg endpoint and uses tjconsultingservices[.]com as a fallback C2. Responses are tokenized using the custom delimiter "#%%#" and dispatched to the implant’s command handler; command output is returned via HTTP POST to /wsdefvvbnhyuijkplmbgfrtt.
From a functionality standpoint NightLedger supports a broad command set, including user/host identity collection (Command 1), remote process execution (3), directory listing (17), file download and upload (20 and 70), screenshot capture (36), DLL loading (43), process and file management (56, 62, 69), logical drive enumeration (75), and process listing (90). It also collects C:\Windows\debug\NetSetup.log together with process-list output (Command 93). Researchers note code and behavioral similarities to TWOSTROKE, a backdoor previously attributed to the same APT and documented by GTIG.
BridgeHead and ArcBridge: WebSocket tunnelers that turn victims into relays
Mirage Kitten’s toolset includes at least two WebSocket-based tunneling implants. BridgeHead was observed deployed as unbcl.dll in %LocalAppData%\\Microsoft\\VisualStudio on an Egyptian machine and as C:\\program files (x86)\\univpn\\promote\\libwinpthread-1.dll in a Pakistan-based environment. The implant dynamically resolves advapi32.dll functions to retrieve the Windows username, converts it to lowercase and searches for a hardcoded substring — a per‑target execution check that causes silent exit if not matched. When activated the tunneler performs an HTTPS WebSocket upgrade (GET /connect to smartconnect.azurewebsites.net) and authenticates by sending a binary WebSocket message containing the literal string "token." The server must respond within 10 seconds or the implant retries with exponential backoff.
BridgeHead implements enterprise proxy traversal: it handles HTTP 407 (Proxy Auth Required) responses by querying supported auth schemes (WinHttpQueryAuthSchemes), preferring Negotiate (0x10) over NTLM (0x2), setting Windows SSO credentials (null username/password) and retrying up to three times; connection retry backoff is capped at 60 seconds. Once the WebSocket channel is established and authenticated the implant acts as a full SOCKS5 tunnel proxy — the C2 initiates tunnel connections and the implant merely forwards TCP traffic, effectively relaying operator tools through the victim’s network.
ArcBridge, first identified in April 2026, follows the same relay model. It creates the mutex F56E68DA-4A89-46B4-9AC8-7290A7651000 and contains an embedded configuration block (example C2 host aecert.org, port 443, timeout 5000 and an implant identifier). ArcBridge supports OPEN (create proxy session) and DNS (resolve hostname/address) commands and communicates over a WebSocket-style channel for server-side control.
Protocol details and operator control
The tunnelers use a fixed binary wire format with an 8‑byte header describing message type, connection ID, flags and payload length. Seven message types were observed: CONNECT (1), CONNECT_RESPONSE (2), DATA (3), DISCONNECT (4), PING (5), PONG (6) and FLOWCTRL (9). The CONNECT payload encodes targets in SOCKS5 address formats: 0x01 for IPv4, 0x03 for domain names and 0x04 for IPv6, followed by a 2‑byte destination port. One BridgeHead variant communicates with businessmixture[.]com/blog over WSS on port 443 rather than Azure, but implements the same username control check and tunneling logic.
Victimology: targets across Middle East and Africa
Telemetry tied to this activity shows victims in Egypt and Pakistan (including a Pakistan-based aerospace and aviation organization), and other targets across the Middle East and Africa. Identified victims include small-to-medium business and government environments in Jordan and Tanzania, telecommunications companies in Ethiopia, and financial-sector entities in Burkina Faso. Deployment followed spear-phishing and recruitment-themed lures — including lookalike videoconferencing pages and fake hiring portals hosted on third‑party file-sharing services — consistent with Mirage Kitten’s documented tradecraft and prior public reporting.
What this means for technologists, affected enterprises, and policymakers
- Technologists and security teams: Expect multi-stage implants combining search‑order DLL hijacks (SspiCli.dll/AppVShNotify.exe), HTTP(S) C2s with custom field delimiters, and WebSocket tunnel proxies that will attempt to traverse corporate proxies using Negotiate/NTLM SSO flows.
- Affected enterprises in aerospace, aviation, defense and telecommunications: Targeted spear‑phishing and recruitment lures are the primary initial vector observed; detection should include monitoring for anomalous DLL loads, WebSocket upgrades to unexpected hosts (e.g., smartconnect.azurewebsites.net or businessmixture[.]com) and unusual outbound SOCKS5‑style TCP relaying.
- Policymakers and procurement leaders: The group’s shift away from Azure subdomain infrastructure toward Cloudflare-backed domains in some malware — coupled with per‑target binary tailoring (username substring checks) — complicates attribution and raises the operational bar for incident response and cross-border takedowns.
Mirage Kitten has expanded a familiar playbook — tailored spear‑phishing, DLL hijacking and operator‑side tooling — with a new reconnaissance-oriented backdoor and resilient WebSocket tunnelers that turn infected hosts into flexible relay nodes. The campaign combines detailed per-target tailoring (hardcoded username checks and UUID mutexes) with enterprise proxy traversal and Cloudflare-backed C2s, underscoring that defenders should watch for WebSocket‑based tunneling and unexpected proxy‑auth negotiation patterns as priority detection signals.
Original report — Mirage Kitten targets Middle East and Africa region with new malware (Securelist)
