Loading malware…
NightLedger is a Windows backdoor associated with the Iran-linked threat actor Mirage Kitten, also tracked as UNC1549, Smoke Sandstorm, and Nimbus Manticore. It has been used in long-term cyber-espionage operations targeting organizations across the Middle East and Africa, including entities in aerospace, aviation, defense, telecommunications, government, financial services, and small and medium-sized business environments.
NightLedger is designed for covert post-compromise access and operator tasking. It has been observed masquerading as a legitimate DLL and executing through DLL search-order hijacking alongside a trusted Windows binary, indicating deliberate tradecraft for stealth and execution. The malware communicates with command-and-control infrastructure over HTTPS and supports a broad set of remote-access and post-exploitation functions. Documented capabilities include host and user reconnaissance, directory and logical drive enumeration, process listing and management, arbitrary process execution, file upload and download, file copy and deletion, screenshot capture, DLL loading, beacon interval updates, and collection of Windows diagnostic logs including NetSetup.log. Its command parsing and overall design have been noted as similar to the TWOSTROKE backdoor previously linked to the same actor.
NightLedger has been reported as part of a broader Mirage Kitten intrusion set that also includes the BridgeHead and ArcBridge tunneling tools, which are used to relay traffic and maintain covert access through victim environments. In observed operations, the broader campaign relied on highly targeted spearphishing, including recruitment-themed lures and fake videoconferencing pages delivering malicious archives. The malware and surrounding tooling reflect victim-specific tailoring, operational security, and a sustained focus on intelligence collection rather than financially motivated activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The centerpiece of the campaign is NightLedger, a newly identified Windows backdoor attributed to Mirage Kitten... Once loaded, NightLedger contacts its C2 infrastructure over HTTPS and supports a broad range of post-compromise activities including system reconnaissance, process execution, directory enumeration, screenshot capture, file upload and download, process management, and collection of Windows diagnostic logs such as NetSetup.log.
The intrusions involve the use of a previously undocumented Windows backdoor called NightLedger... The toolset includes NightLedger, a new Windows backdoor for reconnaissance, command execution, file operations, process discovery, and screenshot capture.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
The implant masquerades as SspiCli.dll and abuses DLL search-order hijacking to execute alongside the legitimate Windows binary AppVShNotify.exe.
Command ID Description 1 Gather user and host identity information
Once loaded, NightLedger contacts its C2 infrastructure over HTTPS and supports a broad range of post-compromise activities including... process management...
Once loaded, NightLedger contacts its C2 infrastructure over HTTPS and supports a broad range of post-compromise activities including system reconnaissance...
23 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A newly identified Windows backdoor used by Mirage Kitten for reconnaissance and post-compromise access. It masquerades as SspiCli.dll, abuses DLL search-order hijacking to run with AppVShNotify.exe, communicates with C2 over HTTPS, and supports command execution, file operations, screenshot capture, process management, and log collection.
A backdoor used for long-term cyber-espionage that provides remote access, command execution, file management, and covert communication to maintain persistence and evade detection.
A previously undocumented Windows backdoor used for reconnaissance, command execution, file operations, process discovery, screenshot capture, host and network information collection, file upload/download, DLL loading, and communication with an external server over HTTPS. It is launched as a DLL via DLL side-loading.
A Windows backdoor attributed to Mirage Kitten that masquerades as SspiCli.dll for DLL search-order hijacking, beacons over HTTPS, and supports reconnaissance, command execution, file and process operations, screenshot capture, DLL loading, and exfiltration of files and NetSetup.log.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.