Mirage Kitten deploys NightLedger and WebSocket tunnelers

Kaspersky researchers described a new toolset attributed to Mirage Kitten on 28 July. The group is also tracked as UNC1549, Smoke Sandstorm and Nimbus Manticore. Its campaign combines carefully tailored social engineering with the NightLedger backdoor and two WebSocket tunnelers—ArcBridge and BridgeHead—that can turn a victim’s computer into a covert transit point for attacker traffic.

The targets are concentrated in aerospace, aviation, defence and telecommunications across the Middle East and Africa. The main defensive lesson goes beyond individual indicators of compromise: a legitimate Windows process, a library named like a system component and encrypted WebSocket traffic can create a channel that looks ordinary when the SOC examines each element in isolation.

Who Mirage Kitten targets

Kaspersky links the activity to espionage campaigns aimed at organisations with strategic value. Researchers observed aerospace and aviation entities in Egypt and Pakistan among the affected environments. The accompanying announcement also identifies activity touching Jordan, Tanzania, Ethiopia and Burkina Faso.

That list does not mean every organisation in those countries was successfully compromised. It describes targets and observations in the investigated campaigns, not a complete victim registry. The group operates selectively, tailoring lures to the recipient’s profession, sector and language.

Initial access: recruitment as a credible lure

In some incidents, the tools appeared after highly targeted spear-phishing. Operators impersonated recruitment firms, created bogus vacancies and built pages that resembled videoconferencing services. The victim was ultimately directed to an archive hosted through an external file-sharing service.

For most investigated cases, however, the exact initial access vector was not confirmed. This distinction matters: similar infrastructure and malware do not automatically prove that every host was infected through the same email. Defenders should look for both social-engineering evidence and alternative entry paths, including compromised accounts, remote access or an earlier foothold on the workstation.

The lure works through context. A recruiter contact, an interview invitation and an archive containing “materials” may appear credible to an aerospace engineer. The email gateway sees a distributed chain: a message, an intermediate web page and a file hosted outside the attacker’s obvious domain.

NightLedger: a backdoor hidden in a DLL chain

NightLedger is a Windows backdoor. The analysed sample masquerades as SspiCli.dll and abuses DLL search-order hijacking. The legitimate AppVShNotify.exe program loads the library indirectly through an RPCRT4 dependency, causing a malicious file placed in the right directory to be selected instead of the system copy.

This is the classic attacker advantage of DLL search-order hijacking: code runs in the context of a legitimately signed executable. A trusted parent process is therefore not enough to declare an event safe. EDR analysis should include the process image path, the origin of every loaded library and the event sequence.

NightLedger creates the mutex A8215357-F99A-44FE-BC65-D8F0434B0C03, communicates over HTTPS and gives its operator a familiar remote-access feature set:

• identifying the host and user;
• executing, listing and terminating processes;
• enumerating directories and drives;
• downloading, uploading, copying and deleting files;
• taking screenshots;
• loading additional DLLs;
• changing the C2 beacon interval;
• collecting C:\Windows\debug\NetSetup.log.

The final capability can expose information about domain joining and network configuration. It illustrates an action that does not look like document theft by itself but improves the attacker’s knowledge for later movement.

ArcBridge and BridgeHead: using the victim as a relay

The campaign’s second pillar is tunnelling. ArcBridge and BridgeHead use WebSocket to carry traffic through a compromised computer. Instead of connecting every operational stage directly to a recognisable C2 server, the operator can use the victim as a relay into other resources.

This has three consequences:

1. command traffic can blend into ordinary HTTPS;
2. the compromised organisation’s address may appear as the origin of follow-on connections;
3. the same host becomes an access point to segments the attacker’s server could not reach directly.

BridgeHead also checks the username and runs only when the account contains an expected substring. This may be an anti-analysis measure or a way to bind the tool to a particular target. Either interpretation shows why a sandbox may not reveal the sample’s complete behaviour: the environment must resemble the victim machine in identity and configuration as well as operating system.

What defenders should monitor

A single IOC ages quickly. Combining indicators with behaviour produces more durable detection:

• AppVShNotify.exe launched from a user directory, extracted archive or another unexpected location;
• SspiCli.dll loaded from outside standard Windows system directories;
• a trusted, signed executable loading an unsigned library from its working directory;
• long-lived WebSocket/HTTPS connections from a workstation that does not normally act as a proxy;
• unusual access to NetSetup.log, screenshot activity or file operations by an unexpected process;
• DNS queries and traffic to domains identified in Kaspersky’s report;
• an earlier archive download after visiting a counterfeit recruitment or conferencing page.

In Microsoft Sysmon, process creation, image loading and network connection events provide useful coverage. A rule that matches the name SspiCli.dll alone will be noisy—the high-confidence condition is its non-system path combined with a process that normally loads the Windows copy.

At the network edge, monitor the WebSocket handshake, session duration, destination domain and device profile. The content is encrypted, but metadata may still expose a workstation holding a long, regular connection to a rare domain.

Responding to a suspicious host

If NightLedger or either tunneller is found, do not stop after deleting the DLL:

1. Isolate the computer while retaining the ability to acquire memory and EDR telemetry.
2. Preserve artefacts: files, mutex information, process tree, loaded modules, DNS, proxy and download history.
3. Find the entry point and identify other people who received the same message or lure.
4. Review lateral movement from the host because the tunneller may have provided access to further systems.
5. Revoke credentials and tokens available to the user or process.
6. Rebuild from a trusted source when the full scope of changes cannot be established with confidence.

The full evidence and decision sequence belongs in an incident response plan. Espionage operators may maintain long dwell times, so “no more alerts” after deleting one sample is not evidence that the environment is clean.

Systemic improvements

High-risk organisations should protect the recruitment journey with the same care as finance and administration. Employees need a safe way to open files from recruiters, and the SOC needs context showing that selected roles are frequent targets.

On the technical side, application control, prevention of library loads from user-writable directories, filtering of unknown file-sharing services and visibility into loaded modules offer the most value. Segmentation reduces the value of a tunneller: a compromised workstation should not have an unrestricted path to administrative environments, engineering servers and OT.

Frequently asked questions

Is WebSocket malicious?
No. It is a legitimate protocol used by many real-time applications. The risk appears when an unusual process or device maintains a tunnel to rare infrastructure. Detection must combine process, destination and duration context.

Does the presence of AppVShNotify.exe prove infection?
No. It is a legitimate Microsoft file. Launching it from an unexpected location and loading a local, non-system SspiCli.dll is what makes the chain suspicious.

Does the report confirm phishing in every case?
No. Kaspersky documents highly targeted lures but states that the precise initial access route was not established for most incidents.

Conclusion

Mirage Kitten’s new arsenal is effective not because it depends on one magical exploit, but because it combines a credible lure, abuse of a legitimate process and flexible tunnelling. Defence requires correlation across email, endpoint and network telemetry—and the assumption that a compromised laptop may be both a victim and a relay into the rest of the organisation. To assess your resilience against this chain, explore BreachRoad’s security testing services.

---

Sources: Kaspersky Securelist — Mirage Kitten’s new malware: NightLedger, ArcBridge and BridgeHead, Kaspersky’s announcement on the Middle East and Africa campaign.