mirage kitten

Executive Summary

Mirage Kitten is an advanced Iranian-backed threat actor targeting high‑value sectors in Middle Eastern, African and South Asian countries through sophisticated spear‑phishing campaigns that masquerade as plagiarism reports or academic notifications. The group deploys a modular toolset—including the NightLedger backdoor, custom WebSocket tunnelers ArcBridge/BridgeHead, Psiphon hijack and Android implants—to achieve stealthy persistence, lateral movement, and exfiltration over Fastly CDN‑based command & control channels.

Goals & Targeting

The primary objective of Mirage Kitten is industrial or economic espionage – harvesting sensitive data from aerospace, defense, telecommunications, government, financial and other high‑value sectors that operate in strategic regions. By targeting academics and professionals with plagiarism‑report style phishing, the actor increases its chance of compromise while keeping a low profile. The group prioritises nations along Middle Eastern, African and South Asian lines of interest, particularly Iran’s regional allies and rival states, reflecting a strategic aim to influence geopolitical balance through information theft.

Key Capabilities

• Spear‑phishing using fake plagiarism reports and academic notifications
• Malicious shortcut (.lnk) attachments that initiate downloads from attacker servers
• Macro‑laden Office documents dropping backdoors such as MarkiRAT and NightLedger
• Custom WebSocket tunnelers (ArcBridge, BridgeHead) for covert C2 over Fastly CDN
• Command & Control infrastructure hosted on Fastly networks
• Persistence via Windows services, scheduled tasks, reboot binaries and anti‑VM checks
• Memory‑resident execution to avoid disk-based detection
• Keylogging and clipboard monitoring capabilities
• File upload/download functionality within backdoors
• Remote command execution through the RAT
• Screenshot capture for reconnaissance
• Chrome browser shortcut hijacking to launch RAT at startup
• Hijacking legitimate VPN software (Psiphon) for stealth
• Android implants targeting mobile devices
• Credential harvesting with injected keyloggers in popular browsers
• Supply‑chain delivery via compromised vendor sites

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Mirage Kitten’s campaigns run with high operational tempo, launching fresh spear‑phishing cycles every few weeks to maintain persistence across diverse industries and locations. Victims tend to be organizations with public-facing academic collaborations or financial services linked to international trade. Notable operations include a 2025 deployment targeting universities in the United Arab Emirates via fake plagiarism reports, and a supply‑chain compromise that used a compromised vendor site to deliver NightLedger across multiple African telecom providers. The actor’s use of Fastly CDN nodes for C2 routing is a distinctive pattern, enabling rapid relocation of infrastructure across countries while masking traffic origins.

IOC Patterns

• malicious PDF disguised as plagiarism report
• phishing email attachment (.lnk) that triggers malicious shortcut download
• fake eLibrary website mimicking real homepage
• Fastly-based URLs used for command and control
• macro‑laden Office document dropping backdoor
• keylogger process on Windows systems
• modified Chrome shortcuts to launch RAT at startup
• WebSocket‑based C2 tunnelers (ArcBridge, BridgeHead)
• Windows backdoor files with reconnaissance capabilities

Recommended Actions

• Deploy robust email filtering and threat intelligence feeds that flag .lnk attachments originating from Fastly CDN domains.
• Implement strict macro policies in Office applications, allowing only digitally signed scripts.
• Train employees to verify academic or plagiarism‑report notifications before opening PDFs or links.
• Enable browser-based security controls to prevent unauthorized shortcut hijacking and keylogger detection.
• Apply regular OS patching, especially for known CVEs such as CVE‑2025‑2783.
• Use reputable VPN solutions rather than unverified third‑party binaries like Psiphon, and monitor for anomalies in VPN traffic patterns.
• Implement endpoint detection and response (EDR) capable of spotting memory‑resident processes and anti‑VM checks.
• Deploy network segmentation to limit lateral movement once a node is compromised.
• Periodically audit third‑party vendor access to identify potential supply‑chain vulnerabilities.
• Employ web filtering to block Fastly CDN IP ranges associated with Mirage Kitten C2 servers.

Suggested Tags