Mirage Kitten Malware Targets Middle East and Africa with New Toolset

The Mirage Kitten APT group has deployed a sophisticated malware suite, including the NightLedger backdoor, across the Middle East and Africa. This campaign has successfully infiltrated sensitive sectors such as government, finance, and telecommunications. The malware utilizes targeted spear-phishing and fake recruitment portals for initial access. NightLedger allows attackers to execute commands, transfer files, and capture screenshots while communicating with command-and-control servers over HTTPS. The attack has impacted organizations in Egypt, Pakistan, Ethiopia, and Burkina Faso, indicating a broad scope of espionage activities. The tools ArcBridge and BridgeHead enhance covert network access, turning compromised systems into relay nodes. This operation aligns with geopolitical interests, as the group is believed to be state-sponsored. The current status indicates ongoing monitoring and analysis by cybersecurity researchers.

Key Points: • Mirage Kitten's new malware suite targets sensitive sectors in the Middle East and Africa. • The NightLedger backdoor enables extensive remote control and data exfiltration capabilities. • The campaign employs sophisticated spear-phishing techniques for initial access.