Mirage Kitten Deploys NightLedger Backdoor and WebSocket Tunneling Tools

The Iranian state-sponsored actor Mirage Kitten (also tracked as Nimbus Manticore and UNC1549) is conducting a cyber-espionage campaign targeting organizations across the Middle East, Africa, and South Asia. The group utilizes a previously undocumented Windows backdoor named NightLedger to establish persistent access. To evade network security controls, the actor employs two custom WebSocket-based tunneling tools, ArcBridge and BridgeHead, which encapsulate C2 traffic to bypass traditional firewall restrictions and network detection systems.

• Campaign Overview: Espionage Operations

  • Target Regions: High-intensity focus on Middle East, Africa, and South Asia.
  • Primary Objective: Strategic cyber espionage and long-term intelligence gathering.
  • Target Environment: Primarily Microsoft Windows-based organizational infrastructure.

• Malware Analysis: NightLedger Backdoor

  • Functionality: Serves as a custom Windows backdoor for remote access and persistence.
  • Capabilities: Enables the actor to execute commands, deploy additional payloads, and maintain a foothold.
  • Deployment: Deployed as the primary agent for facilitating internal network reconnaissance.

• Tunneling Mechanics: ArcBridge and BridgeHead

  • Protocol Utilization: Employs WebSocket protocols to encapsulate and tunnel traffic.
  • Evasion Strategy: Bypasses traditional firewalls by masquerading malicious traffic as legitimate web traffic.
  • Operational Role: Maintains a secure, stealthy communication channel between the infected host and C2 infrastructure.

• Threat Actor Profile: Mirage Kitten

  • Attribution: Iranian state-sponsored entity also known as Nimbus Manticore, Smoke Sandstorm, and UNC1549.
  • Tooling Sophistication: Development of bespoke tunneling tools indicates a high level of investment in evasion.
  • Behavioral Pattern: Consistent focus on regional geopolitical targets using tailored malware families.

• Defensive Actions & Mitigation

  • Network Monitoring: Implement deep packet inspection (DPI) to identify anomalous WebSocket traffic patterns.
  • Endpoint Detection: Deploy EDR rules to detect the execution and persistence mechanisms of the NightLedger binary.
  • Egress Filtering: Enforce strict outbound firewall rules to limit unauthorized tunneling and non-standard port usage.

• Conclusion: Strategic Impact

  • Risk Level: High for government and critical infrastructure entities in targeted regions.
  • Key Takeaway: The shift toward WebSocket tunneling demonstrates an evolving effort to neutralize traditional perimeter defenses.