SecurityOnlineDo Son
Iran linked Mirage Kitten rolls out NightLedger backdoor in MEA
Part of the UNC1549 story · since 19 Sep 2025
Quiet for 8 weekslast report 7 Sep18 articles9 outlets
- Fri 19 Sep, 16:30 UTC. The Hacker News, first report. UNC1549 Hacks 34 Devices in 11 Telecom Firms via LinkedIn Job Lures and MINIBIKE Malware.
- Mon 22 Sep, 13:05 UTC. Check Point, its first report on the story. Nimbus Manticore Deploys New Malware Targeting Europe.
- Tue 23 Sep, 08:13 UTC. GBHackers, its first report on the story. Nimbus Manticore Targets Defense and Telecom Industries with New Malware Attack.
- Wed 24 Sep, 01:16 UTC. SecurityOnline, its first report on the story. Iranian APT “Nimbus Manticore” Intensifies Cyber Espionage in Europe.
- Tue 18 Nov, 22:26 UTC. Dark Reading, its first report on the story. Iran-Nexus Threat Actor UNC1549 Takes Aim at Aerospace.
- Wed 19 Nov, 03:20 UTC. SecurityOnline. Iranian APT UNC1549 Infiltrates Aerospace by Hijacking Trusted DLLs and Executing VDI Breakouts.
- Tue 5 May, 02:31 UTC. Infosecurity, its first report on the story. US defence contractors warned of nation state edge device attacks.
- Fri 22 May, 15:48 UTC. Check Point. Iranian hackers revive with SEO poison, fake Zoom and AI backdoor.
- Tue 26 May, 09:18 UTC. The Hacker News. Hackers Use MiniFast, MiniJunk V2 in Phishing, SEO Poisoning.
- Tue 26 May, 09:18 UTC. Security Affairs, its first report on the story. Iranian hackers use AI malware, SEO tricks in US aviation attacks.
- Tue 26 May, 09:18 UTC. Infosecurity. Nimbus Manticore hackers hit US aviation via fake Oracle SQL page.
- Tue 26 May, 13:29 UTC. SecurityWeek, its first report on the story. Iranian APT Nimbus Manticore Shifts Focus to US Aviation Software.
- Tue 28 Jul, 08:31 UTC. Securelist, its first report on the story. Mirage Kitten APT Deploys NightLedger on Aerospace & Telecom.
- Tue 28 Jul, 12:51 UTC. The Hacker News. NightLedger Malware Hijacks Victim PCs as Covert Espionage Relays.
- Sat 1 Aug, 02:11 UTC. SecurityOnline. Iran linked Mirage Kitten rolls out NightLedger backdoor in MEA. This article, 15th of 18.
- Wed 26 Aug, 18:20 UTC. The Hacker News. Nimbus Manticore adds TWOSTROKE backdoor and SSH tunneller.
- Tue 1 Sep, 13:31 UTC. The Hacker News. Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests.
- Mon 7 Sep, 10:49 UTC. SecurityOnline. Mirage Kitten Targets Developers With Dual Backdoors in Coding Tests.
Kaspersky has reported on the Mirage Kitten malware, also known as UNC1549, which targets sectors like aviation, defense, telecom, government, and finance across the Middle East and Africa. This state-aligned espionage group has deployed a new Windows backdoor called NightLedger, alongside two tunneling tools, ArcBridge and BridgeHead. The malware utilizes social engineering tactics, such as recruitment-themed messages, to lure victims.
The group has been linked to Iran's IRGC, and its activities represent a continuation of earlier cyber espionage strategies. Protection measures include employee training to recognize malicious lures, enforcing multi-factor authentication, and monitoring for suspicious activity.
How the story developed
Quiet for 8 weekslast report 7 Sep18 articles9 outlets
18 articles from 9 outlets since 19 Sep. Quiet since 7 Sep. This was the 15th report, 315 days after the first.
- Fri 19 Sep, 16:30 UTC. The Hacker News, first report. UNC1549 Hacks 34 Devices in 11 Telecom Firms via LinkedIn Job Lures and MINIBIKE Malware.
- Mon 22 Sep, 13:05 UTC. Check Point, its first report on the story. Nimbus Manticore Deploys New Malware Targeting Europe.
- Tue 23 Sep, 08:13 UTC. GBHackers, its first report on the story. Nimbus Manticore Targets Defense and Telecom Industries with New Malware Attack.
- Wed 24 Sep, 01:16 UTC. SecurityOnline, its first report on the story. Iranian APT “Nimbus Manticore” Intensifies Cyber Espionage in Europe.
- Tue 18 Nov, 22:26 UTC. Dark Reading, its first report on the story. Iran-Nexus Threat Actor UNC1549 Takes Aim at Aerospace.
- Wed 19 Nov, 03:20 UTC. SecurityOnline. Iranian APT UNC1549 Infiltrates Aerospace by Hijacking Trusted DLLs and Executing VDI Breakouts.
- Tue 5 May, 02:31 UTC. Infosecurity, its first report on the story. US defence contractors warned of nation state edge device attacks.
- Fri 22 May, 15:48 UTC. Check Point. Iranian hackers revive with SEO poison, fake Zoom and AI backdoor.
- Tue 26 May, 09:18 UTC. The Hacker News. Hackers Use MiniFast, MiniJunk V2 in Phishing, SEO Poisoning.
- Tue 26 May, 09:18 UTC. Security Affairs, its first report on the story. Iranian hackers use AI malware, SEO tricks in US aviation attacks.
- Tue 26 May, 09:18 UTC. Infosecurity. Nimbus Manticore hackers hit US aviation via fake Oracle SQL page.
- Tue 26 May, 13:29 UTC. SecurityWeek, its first report on the story. Iranian APT Nimbus Manticore Shifts Focus to US Aviation Software.
- Tue 28 Jul, 08:31 UTC. Securelist, its first report on the story. Mirage Kitten APT Deploys NightLedger on Aerospace & Telecom.
- Tue 28 Jul, 12:51 UTC. The Hacker News. NightLedger Malware Hijacks Victim PCs as Covert Espionage Relays.
- Sat 1 Aug, 02:11 UTC. SecurityOnline. Iran linked Mirage Kitten rolls out NightLedger backdoor in MEA. This article, 15th of 18.
- Wed 26 Aug, 18:20 UTC. The Hacker News. Nimbus Manticore adds TWOSTROKE backdoor and SSH tunneller.
- Tue 1 Sep, 13:31 UTC. The Hacker News. Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests.
- Mon 7 Sep, 10:49 UTC. SecurityOnline. Mirage Kitten Targets Developers With Dual Backdoors in Coding Tests.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 18 articles as a listHide the list
- Fri 19 SepDay 01
- UNC1549 Hacks 34 Devices in 11 Telecom Firms via LinkedIn Job Lures and MINIBIKE Malware16:30 · The Hacker News · First report
Quiet for 3 days
Mon 22 SepDay 31- Nimbus Manticore Deploys New Malware Targeting Europe13:05 · Check Point · Picked up again
- Tue 23 SepDay 41
- Wed 24 SepDay 51
- Iranian APT “Nimbus Manticore” Intensifies Cyber Espionage in Europe01:16 · SecurityOnline
Quiet for 8 weeks
Tue 18 NovDay 601- Iran-Nexus Threat Actor UNC1549 Takes Aim at Aerospace22:26 · Dark Reading · Picked up again
- Wed 19 NovDay 611
Quiet for 24 weeks
Tue 5 MayDay 2281- US defence contractors warned of nation state edge device attacks02:31 · Infosecurity · Picked up again
Quiet for 3 weeks
Fri 22 MayDay 2451- Iranian hackers revive with SEO poison, fake Zoom and AI backdoor15:48 · Check Point · Picked up again
Quiet for 4 days
Tue 26 MayDay 2494- Hackers Use MiniFast, MiniJunk V2 in Phishing, SEO Poisoning09:18 · The Hacker News · Picked up again
- Iranian hackers use AI malware, SEO tricks in US aviation attacks09:18 · Security Affairs
- Nimbus Manticore hackers hit US aviation via fake Oracle SQL page09:18 · Infosecurity
- Iranian APT Nimbus Manticore Shifts Focus to US Aviation Software13:29 · SecurityWeek
Quiet for 9 weeks
Tue 28 JulDay 3122- Mirage Kitten APT Deploys NightLedger on Aerospace & Telecom08:31 · Securelist · Picked up again
- NightLedger Malware Hijacks Victim PCs as Covert Espionage Relays12:51 · The Hacker News
Quiet for 4 days
Sat 1 AugDay 3161- Iran linked Mirage Kitten rolls out NightLedger backdoor in MEA02:11 · SecurityOnline · Picked up again · This article, 15th of 18
Quiet for 4 weeks
Wed 26 AugDay 3411- Nimbus Manticore adds TWOSTROKE backdoor and SSH tunneller18:20 · The Hacker News · Picked up again
Quiet for 6 days
Tue 1 SepDay 3471- Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests13:31 · The Hacker News · Picked up again
Quiet for 6 days
Mon 7 SepDay 3531- Mirage Kitten Targets Developers With Dual Backdoors in Coding Tests10:49 · SecurityOnline · Picked up again