Loading threat actor…
Mirage Kitten is an Iran-linked advanced persistent threat focused on long-term cyber-espionage. The group is also tracked as UNC1549, Smoke Sandstorm, and Nimbus Manticore. Its operations have targeted organizations across the Middle East, Africa, and parts of Europe, with observed victimology including aerospace, aviation, defense, telecommunications, government, and financial-sector entities, as well as smaller business environments. Mirage Kitten commonly gains initial access through highly targeted spear-phishing and social-engineering campaigns. Observed lures have included recruitment-themed messages impersonating employers or hiring platforms and fake videoconferencing pages designed to deliver malicious archives. Post-compromise activity shows an emphasis on maintaining covert, durable access for intelligence collection rather than disruptive or financially motivated outcomes. The group has used bespoke malware including the NightLedger Windows backdoor and the BridgeHead and ArcBridge tunneling tools. NightLedger supports host reconnaissance, command execution, directory and drive enumeration, process management, screenshot capture, file upload and download, and collection of diagnostic artifacts, enabling broad post-exploitation and exfiltration functions. It has been observed using DLL search-order hijacking for execution and shares development and behavioral similarities with earlier Mirage Kitten tooling such as TWOSTROKE. BridgeHead and ArcBridge are WebSocket-based tunneling utilities used to relay operator traffic through compromised hosts, enabling covert remote access, proxying, and DNS resolution from victim networks. BridgeHead has also been observed supporting enterprise proxy authentication with Windows single sign-on credentials. A notable characteristic of Mirage Kitten’s tooling is victim-specific tailoring. Observed samples included execution controls tied to the local Windows username, indicating efforts to restrict malware activation to intended targets and reduce exposure in automated analysis environments. The group has also continued to invest in custom command-and-control tradecraft and infrastructure changes, including use of encrypted communications and a gradual shift in parts of its infrastructure to improve resilience and complicate attribution. Overall, Mirage Kitten is a specialized espionage actor aligned with Iranian interests, distinguished by targeted phishing, custom multi-stage malware, covert tunneling utilities, persistence-focused post-exploitation, and sustained collection against strategic sectors.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
26 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
7 malware families attributed to this actor across reporting.
2 additional families tracked in Mallory.
24 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting long-term cyber-espionage operations across the Middle East and Africa, targeting aerospace, aviation, defense, telecommunications, government, financial, and SMB sectors using tailored spear-phishing, recruitment-themed lures, fake videoconferencing pages, and bespoke malware for reconnaissance, command execution, covert tunneling, and persistent post-compromise access.
Conducting long-term cyber-espionage operations using the NightLedger backdoor and ArcBridge/BridgeHead tunneling tools for remote access, command execution, file management, covert communications, persistence, and evasion.
Conducting targeted cyber-espionage operations across the Middle East, Europe, and Africa using spear-phishing, fake recruitment portals, custom backdoors, and WebSocket-based tunneling tools for persistence, covert access, and data exfiltration.
Conducting targeted cyber-espionage operations across the Middle East, Europe, and Africa against aerospace, aviation, defense, telecommunications, government, SMB, and financial-sector entities using spear-phishing, fake recruitment portals, lookalike videoconferencing pages, custom backdoors, and WebSocket-based tunneling tools.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.