SecurelistOmar Amin, Vasily Berdnikov
Mirage Kitten APT Deploys NightLedger on Aerospace & Telecom
Part of the Bohrium story · since 28 Jul
- Tue 28 Jul, 08:31 UTC. Securelist, first report. Mirage Kitten APT Deploys NightLedger on Aerospace & Telecom. This article, 1st of 2.
- Mon 7 Sep, 10:49 UTC. SecurityOnline, its first report on the story. Mirage Kitten Targets Developers With Dual Backdoors in Coding Tests.
The article discusses the Mirage Kitten APT group, detailing its focus on cyber-espionage in sectors like aerospace and telecommunications, particularly in the Middle East and Europe. It highlights newly identified malware tools, including the NightLedger backdoor, which enables reconnaissance and command execution, and two WebSocket tunneling tools, ArcBridge and BridgeHead, which facilitate covert network access.
The article also outlines the technical functionalities of these tools, their deployment through spear-phishing, and the group's evolving tactics to maintain a resilient command-and-control infrastructure. It concludes with a summary of the cybersecurity implications and victimology associated with these attacks.
How the story developed
2 articles from 2 outlets since 28 Jul. Quiet since 7 Sep. This was the first report.
- Tue 28 Jul, 08:31 UTC. Securelist, first report. Mirage Kitten APT Deploys NightLedger on Aerospace & Telecom. This article, 1st of 2.
- Mon 7 Sep, 10:49 UTC. SecurityOnline, its first report on the story. Mirage Kitten Targets Developers With Dual Backdoors in Coding Tests.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 2 articles as a listHide the list
- Tue 28 JulDay 01
- Mirage Kitten APT Deploys NightLedger on Aerospace & Telecom08:31 · Securelist · First report · This article, 1st of 2
Quiet for 6 weeks
Mon 7 SepDay 411- Mirage Kitten Targets Developers With Dual Backdoors in Coding Tests10:49 · SecurityOnline · Picked up again