When your computer becomes a secret "transfer station" for cyber spies
Overview
Imagine: an HR employee at an airline company in Pakistan receives an attractive interview invitation from a recruiting brand that seems very familiar. A video call is scheduled. But that "meeting room" link led to a seemingly harmless compressed file — and just a few clicks later, their computer quietly turned into a "back door" for the entire organization's internal network, sophisticated enough to fool even the most stringent network defenses.
That's not a hypothetical situation. That is exactly what Kaspersky GReAT has just exposed in a report published at the end of July 2026: a completely new set of malicious tools, never before recorded, developed and deployed by a cyber espionage group called Mirage Kitten in a campaign spanning from Egypt, Jordan, Tanzania to Pakistan, Ethiopia and Burkina Faso.
What makes this campaign worth "dissecting" carefully lies not only in its large geographical scope, but in the way the attackers designed a trio of tools to coordinate with each other methodically:
NightLedger – the remote control "brain", silently residing under the shell of a legitimate system DLL file.
ArcBridge and BridgeHead - two secret "pipes" that turn the victim's computer into a transfer station, making all attack traffic look like it is coming from within the internal network.
So how do these tools actually work at the technical layer? Why can they "circumvent" both enterprise proxy systems and analytical sandbox environments?
Hacker Profile
Other names: UNC1549, Smoke Sandstorm, Nimbus Manticore, GalaxyGato.
Suspected origin: Iran (State-sponsored).
Strategic goal: Cyber espionage, gathering intelligence, tracking and stealing sensitive documents instead of blackmail or financial purposes.
Activity habits (TTPs):
Frequently create sophisticated social engineering scenarios, such as creating fake recruitment websites of reputable brands, or fake online meeting (videoconferencing) websites to trick victims into downloading malicious code.
Focus on developing custom tools to bypass traditional detection systems.
History of Dangerous Offensive Campaigns
Although the NightLedger distribution campaign has only recently received attention, the Mirage Kitten group (or UNC1549, Smoke Sandstorm) has had a long history of activity since at least June 2022. Here are notable campaigns and attacks from their history:
Supply-chain & Third-party compromise attacks: This group often targets service providers or third-party suppliers that have weaker security systems. After successfully infiltrating, they take advantage of trust to reach their main targets, which are government agencies and large corporations.
Identity theft "DCSync" campaign: In many previous intrusions, after entering the system, Mirage Kitten used custom tools (such as DCSYNCER.SLICK) to perform DCSync attack techniques. This technique allows them to impersonate an identity management system (Domain Controller), thereby stealing all passwords of employees in the company.
Abusing internal IT systems (Ticketing Systems): The group was once discovered to penetrate and abuse IT support systems (IT service ticketing systems) of businesses to collect internal information, thereby finding weaknesses and spreading malicious code.
Campaign targeting Western Europe: In addition to the traditional target of the Middle East, this group has expanded its cyber espionage campaign targeting Western European countries such as Denmark, Sweden, and Portugal, focusing on the fields of aviation, space and defense.
Diverse arsenal: Before NightLedger, the group used a variety of other self-developed backdoor and data exfiltration tools such as MiniJunk, MiniBrowse, MINIBIKE, MINIBUS, and the LIGHTRAIL tunneling tool. This shows a continuous and methodical investment in cyber attack capabilities.
Event Timeline
June 2026: C2 domains (such as buisness-centeral-transportation.com, maadinglobal.com) are registered and prepared for the campaign.
July 2026: Kaspersky and other security firms (such as SOCRadar) discovered and published a detailed report on a new malware toolkit.
July 28, 2026: Kaspersky's detailed report is published on Securelist, exposing core tools including NightLedger, ArcBridge and BridgeHead.
Phases of Attack
The latest campaign is carried out through 4 main steps as follows:
Step 1: Preparation & Decoy (Weaponization & Delivery): Hackers set up fake online meeting or recruitment websites. They then send targeted spear-phishing emails (like sending interview invitations or important documents). When the victim clicks on a link or downloads a malicious archive, the infection process begins.
Step 2: Infiltration & Installation (Exploitation & Installation): When the victim opens the file, the malicious code uses the "DLL Side-loading" technique (taking advantage of clean, legitimate software to secretly download a DLL library file containing malicious code) to bypass anti-virus software.
Step 3: Stealth & Tunneling: After getting inside, they install a back door (NightLedger) and deploy "tunnelers" (ArcBridge, BridgeHead) to create underground connections (WebSocket-based tunnels) to the control server (C2).
Step 4: Control & Steal (C2 & Actions on Objectives): Through underground tunnels, hackers can review the entire system (process discovery), take screenshots, execute arbitrary commands and siphon sensitive data out while the access flow still looks exactly like normal network communications.
Detailed Technical Analysis
Unlike campaigns using available software, Mirage Kitten uses a set of three extremely sophisticated custom toolkits:
NightLedger (Backdoor): This is a completely new Windows backdoor. NightLedger acts as an internal control center, providing hackers with remote control. Main functions include:
Survey the system and list the process (process discovery).
Arbitrary command execution.
Operate files (create, delete, copy).
Take screenshots to monitor user behavior.
The main infection technique is DLL Side-loading, which takes advantage of standard Windows executable files or legitimate software to silently invoke malicious code.
ArcBridge & BridgeHead (Tunneling Tools): These are custom tunneling tools based on the WebSocket protocol. Their function is to turn the infected computer into a relay node. Thanks to these two tools:
Any stolen data or control commands from C2 are hidden and encrypted inside WebSocket streams.
Network monitoring systems (Firewall, IPS/IDS) will be difficult to detect because the traffic flow looks like a normal web connection.
Helps hackers easily bypass strict firewalls and maintain persistent access.
Cobalt Strike: Deployed after NightLedger has established a "foothold". Cobalt Strike Beacons help attack groups perform post-exploitation, lateral movement within the network to search for servers containing more important data.
IOC & Artifacts
Domains (Used for C2 & Lure)
global-reds[.]com
maadinglobal[.]com
neexportfolio[.]com
buisness-centeral-transportation[.]com
realhealthshop[.]com
aecert[.]org
tjconsultingservices[.]com
thehealth-life[.]com
healthcarezoomcenteral[.]org
business-deegital[.]com
IP
- 172.86.98.113
File Hashes (MD5) - Malware / DLLs
a239e655709a2518dd0b7bdbed163679
c832ecd135781b11f59e3fffb3d2b6ac
afb1c1583606599c7272cfb33cc6f498
f7d36cc5904a53252d2bb3d21615134f
5fa15ef96808ea82f0a6176f0bb4b386
ae628efa305387b633dce82f9364875b
42f847597109da2a220391bb09d00676
d09b14a2fe01c7363ecc56f5d046162c
c90f0efadbf322e5eb1c4103a38c30e6
6038d42af0affd1fb263f470c0956f6b
MITRE ATT&CK Mapping
Initial Access: T1566.002 (Phishing: Spearphishing Link) - Using fake websites.
Execution: T1059 (Command and Scripting Interpreter), T1574.002 (DLL Side-Loading).
Persistence: T1543 (Create or Modify System Process).
Defense Evasion: T1574.002 (DLL Side-Loading), T1027 (Obfuscated Files or Information).
Collection: T1113 (Screen Capture), T1005 (Data from Local System).
Command and Control: T1572 (Protocol Tunneling), T1102 (Web Service) - Use WebSocket.
Expert opinion
Level of sophistication: Very high. The self-development and use of custom backdoor (NightLedger) and tunneling tools (ArcBridge, BridgeHead) shows that this group has a systematic R&D team, constantly updating tools to circumvent current security measures.
Trend forecast: The shift to using underground tunneling tools (WebSocket Tunneling) is becoming a trend for APT groups, because it allows hiding among the huge web traffic of businesses.
Risk for Vietnam: Although the current target is the Middle East, Africa and Western Europe, Spear-phishing techniques with DLL Side-loading or attacks through the supply chain are extremely dangerous tactics. Organizations in Vietnam (especially in the fields of aviation, telecommunications and government) need to take this as an important reference lesson to strengthen the system.
Recommended
Immediate (0-24h):
Immediately update IOCs (Domain, IP, Hash) to the blacklist of Firewall, EDR, SIEM.
Scan (hunt) across the network to search for suspicious hashes or DLL files.
Short term (1-7 days):
Review warnings about unusual processes initiated from legitimate software (DLL Side-loading prevention).
Train employees to be wary of interview invitation emails or strange online meeting links.
Long term:
Invest in a Network Traffic Analysis (NTA) or NDR solution that has the ability to decode and deeply analyze WebSocket packets.
Applying a Zero Trust model, ensures that even if a device is infected, it cannot communicate freely with other devices on the network.
