# When your computer becomes a secret "transfer station" for cyber spies

## Overview

Imagine: an HR employee at an airline company in Pakistan receives an attractive interview invitation from a recruiting brand that seems very familiar. A video call is scheduled. But that "meeting room" link led to a seemingly harmless compressed file — and just a few clicks later, their computer quietly turned into a "back door" for the entire organization's internal network, sophisticated enough to fool even the most stringent network defenses.

That's not a hypothetical situation. That is exactly what Kaspersky GReAT has just exposed in a report published at the end of July 2026: a completely new set of malicious tools, never before recorded, developed and deployed by a cyber espionage group called Mirage Kitten in a campaign spanning from Egypt, Jordan, Tanzania to Pakistan, Ethiopia and Burkina Faso.

What makes this campaign worth "dissecting" carefully lies not only in its large geographical scope, but in the way the attackers designed a trio of tools to coordinate with each other methodically:

*   NightLedger – the remote control "brain", silently residing under the shell of a legitimate system DLL file.
    
*   ArcBridge and BridgeHead - two secret "pipes" that turn the victim's computer into a transfer station, making all attack traffic look like it is coming from within the internal network.
    

So how do these tools actually work at the technical layer? Why can they "circumvent" both enterprise proxy systems and analytical sandbox environments?

## Hacker Profile

*   Other names: UNC1549, Smoke Sandstorm, Nimbus Manticore, GalaxyGato.
    
*   Suspected origin: Iran (State-sponsored).
    
*   Strategic goal: Cyber ​​espionage, gathering intelligence, tracking and stealing sensitive documents instead of blackmail or financial purposes.
    

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/1e714e6a-1ab9-4878-90a7-6ba3ee3dd436.png align="center")

*   Activity habits (TTPs):
    
    *   Frequently create sophisticated social engineering scenarios, such as creating fake recruitment websites of reputable brands, or fake online meeting (videoconferencing) websites to trick victims into downloading malicious code.
        
    *   Focus on developing custom tools to bypass traditional detection systems.
        

## History of Dangerous Offensive Campaigns

Although the NightLedger distribution campaign has only recently received attention, the Mirage Kitten group (or UNC1549, Smoke Sandstorm) has had a long history of activity since at least June 2022. Here are notable campaigns and attacks from their history:

*   Supply-chain & Third-party compromise attacks: This group often targets service providers or third-party suppliers that have weaker security systems. After successfully infiltrating, they take advantage of trust to reach their main targets, which are government agencies and large corporations.
    
*   Identity theft "DCSync" campaign: In many previous intrusions, after entering the system, Mirage Kitten used custom tools (such as DCSYNCER.SLICK) to perform DCSync attack techniques. This technique allows them to impersonate an identity management system (Domain Controller), thereby stealing all passwords of employees in the company.
    
*   Abusing internal IT systems (Ticketing Systems): The group was once discovered to penetrate and abuse IT support systems (IT service ticketing systems) of businesses to collect internal information, thereby finding weaknesses and spreading malicious code.
    
*   Campaign targeting Western Europe: In addition to the traditional target of the Middle East, this group has expanded its cyber espionage campaign targeting Western European countries such as Denmark, Sweden, and Portugal, focusing on the fields of aviation, space and defense.
    
*   Diverse arsenal: Before NightLedger, the group used a variety of other self-developed backdoor and data exfiltration tools such as MiniJunk, MiniBrowse, MINIBIKE, MINIBUS, and the LIGHTRAIL tunneling tool. This shows a continuous and methodical investment in cyber attack capabilities.
    

## Event Timeline

*   June 2026: C2 domains (such as buisness-centeral-transportation.com, maadinglobal.com) are registered and prepared for the campaign.
    
*   July 2026: Kaspersky and other security firms (such as SOCRadar) discovered and published a detailed report on a new malware toolkit.
    
*   July 28, 2026: Kaspersky's detailed report is published on Securelist, exposing core tools including NightLedger, ArcBridge and BridgeHead.
    

## Phases of Attack

The latest campaign is carried out through 4 main steps as follows:

Step 1: Preparation & Decoy (Weaponization & Delivery): Hackers set up fake online meeting or recruitment websites. They then send targeted spear-phishing emails (like sending interview invitations or important documents). When the victim clicks on a link or downloads a malicious archive, the infection process begins.

Step 2: Infiltration & Installation (Exploitation & Installation): When the victim opens the file, the malicious code uses the "DLL Side-loading" technique (taking advantage of clean, legitimate software to secretly download a DLL library file containing malicious code) to bypass anti-virus software.

Step 3: Stealth & Tunneling: After getting inside, they install a back door (NightLedger) and deploy "tunnelers" (ArcBridge, BridgeHead) to create underground connections (WebSocket-based tunnels) to the control server (C2).

Step 4: Control & Steal (C2 & Actions on Objectives): Through underground tunnels, hackers can review the entire system (process discovery), take screenshots, execute arbitrary commands and siphon sensitive data out while the access flow still looks exactly like normal network communications.

## Detailed Technical Analysis

Unlike campaigns using available software, Mirage Kitten uses a set of three extremely sophisticated custom toolkits:

*   NightLedger (Backdoor): This is a completely new Windows backdoor. NightLedger acts as an internal control center, providing hackers with remote control. Main functions include:
    
    *   Survey the system and list the process (process discovery).
        
    *   Arbitrary command execution.
        
    *   Operate files (create, delete, copy).
        
    *   Take screenshots to monitor user behavior.
        
    *   The main infection technique is DLL Side-loading, which takes advantage of standard Windows executable files or legitimate software to silently invoke malicious code.
        
*   ArcBridge & BridgeHead (Tunneling Tools): These are custom tunneling tools based on the WebSocket protocol. Their function is to turn the infected computer into a relay node. Thanks to these two tools:
    
    *   Any stolen data or control commands from C2 are hidden and encrypted inside WebSocket streams.
        
    *   Network monitoring systems (Firewall, IPS/IDS) will be difficult to detect because the traffic flow looks like a normal web connection.
        
    *   Helps hackers easily bypass strict firewalls and maintain persistent access.
        
*   Cobalt Strike: Deployed after NightLedger has established a "foothold". Cobalt Strike Beacons help attack groups perform post-exploitation, lateral movement within the network to search for servers containing more important data.
    

## **IOC & Artifacts**

### Domains (Used for C2 & Lure)

*   global-reds\[.\]com
    
*   maadinglobal\[.\]com
    
*   neexportfolio\[.\]com
    
*   buisness-centeral-transportation\[.\]com
    
*   realhealthshop\[.\]com
    
*   aecert\[.\]org
    
*   tjconsultingservices\[.\]com
    
*   thehealth-life\[.\]com
    
*   healthcarezoomcenteral\[.\]org
    
*   business-deegital\[.\]com
    

### IP

*   172.86.98.113
    

### File Hashes (MD5) - Malware / DLLs

*   a239e655709a2518dd0b7bdbed163679
    
*   c832ecd135781b11f59e3fffb3d2b6ac
    
*   afb1c1583606599c7272cfb33cc6f498
    
*   f7d36cc5904a53252d2bb3d21615134f
    
*   5fa15ef96808ea82f0a6176f0bb4b386
    
*   ae628efa305387b633dce82f9364875b
    
*   42f847597109da2a220391bb09d00676
    
*   d09b14a2fe01c7363ecc56f5d046162c
    
*   c90f0efadbf322e5eb1c4103a38c30e6
    
*   6038d42af0affd1fb263f470c0956f6b
    

## **MITRE ATT&CK Mapping**

*   Initial Access: T1566.002 (Phishing: Spearphishing Link) - Using fake websites.
    
*   Execution: T1059 (Command and Scripting Interpreter), T1574.002 (DLL Side-Loading).
    
*   Persistence: T1543 (Create or Modify System Process).
    
*   Defense Evasion: T1574.002 (DLL Side-Loading), T1027 (Obfuscated Files or Information).
    
*   Collection: T1113 (Screen Capture), T1005 (Data from Local System).
    
*   Command and Control: T1572 (Protocol Tunneling), T1102 (Web Service) - Use WebSocket.
    

## Expert opinion

*   Level of sophistication: Very high. The self-development and use of custom backdoor (NightLedger) and tunneling tools (ArcBridge, BridgeHead) shows that this group has a systematic R&D team, constantly updating tools to circumvent current security measures.
    
*   Trend forecast: The shift to using underground tunneling tools (WebSocket Tunneling) is becoming a trend for APT groups, because it allows hiding among the huge web traffic of businesses.
    
*   Risk for Vietnam: Although the current target is the Middle East, Africa and Western Europe, Spear-phishing techniques with DLL Side-loading or attacks through the supply chain are extremely dangerous tactics. Organizations in Vietnam (especially in the fields of aviation, telecommunications and government) need to take this as an important reference lesson to strengthen the system.
    

## Recommended

*   Immediate (0-24h):
    
    *   Immediately update IOCs (Domain, IP, Hash) to the blacklist of Firewall, EDR, SIEM.
        
    *   Scan (hunt) across the network to search for suspicious hashes or DLL files.
        
*   Short term (1-7 days):
    
    *   Review warnings about unusual processes initiated from legitimate software (DLL Side-loading prevention).
        
    *   Train employees to be wary of interview invitation emails or strange online meeting links.
        
*   Long term:
    
    *   Invest in a Network Traffic Analysis (NTA) or NDR solution that has the ability to decode and deeply analyze WebSocket packets.
        
    *   Applying a Zero Trust model, ensures that even if a device is infected, it cannot communicate freely with other devices on the network.
        

## References

*   [IT News Africa: Kaspersky uncovers new Mirage Kitten malware used in cyber-espionage campaign](https://www.itnewsafrica.com/2026/07/kaspersky-uncovers-new-mirage-kitten-malware-used-in-cyber-espionage-campaign/)
    
*   [SOCRadar: Mirage Kitten targets Middle East and Africa region with new malware](https://socradar.io/free-tools/ioc-radar/reports/mirage-kitten-targets-middle-east-and-africa-region-with-new-malware-9ae312085f9d)
    
*   [Securelist: Mirage Kitten’s new malware set: NightLedger backdoor and two tunneling tools](https://securelist.com/mirage-kitten-new-tools/120811/)