Kaspersky’s Global Research and Analysis Team (GReAT) has identified a new cyberattack toolset deployed by the Advanced Persistent Threat (APT) group known as Mirage Kitten. Details of the discovery were shared at Kaspersky’s annual Cybersecurity Weekend event for the Middle East, Türkiye, and Africa (META) region.
According to the company, researchers found that the group has targeted a range of victims across the Middle East and Africa, including organizations in Egypt, small and medium-sized businesses and public institutions in Jordan and Tanzania, aviation entities in Pakistan, telecommunications companies in Ethiopia, and financial-sector organizations in Burkina Faso.
The newly uncovered toolset consists of three custom-built programs. At its core is a previously undocumented Windows backdoor named NightLedger, which shares code structure and behavioral traits with malware previously linked to the group — similarities that led researchers to attribute it to Mirage Kitten. NightLedger allows attackers to remotely control compromised systems, execute commands, view and exfiltrate files, and capture screenshots.
NightLedger is accompanied by two covert tunneling tools, ArcBridge and BridgeHead, which turn infected computers into intermediary nodes, routing traffic from the attackers’ own servers through the victim’s machine. This makes the traffic appear as though it originates from within the victim’s network, allowing attackers to bypass network security controls and maintain undetected access over extended periods.
The first of these tools was detected in April during attacks targeting victims in the Middle East. In most cases, how attackers initially gained access to the targeted systems remains unclear.
Kaspersky GReAT researchers found that BridgeHead was used in post-compromise activity on systems belonging to victims in Egypt as well as within the infrastructure of an aviation and aerospace organization in Pakistan. In these cases, the intrusions followed targeted phishing attacks consistent with methods the group has used previously — including recruitment-themed messages impersonating trusted brands and hiring platforms, as well as fake video-conferencing pages designed to redirect victims to malicious archive files hosted on third-party file-sharing services.
“Organizations and security teams need to strengthen their capabilities”
Commenting on the findings, Kaspersky GReAT Senior Security Researcher Omar Amin said the latest discoveries show that Mirage Kitten continues to expand its malware arsenal in support of targeted cyberespionage operations across the Middle East and Africa.
Amin noted that another notable aspect of the campaign is the group’s continued use of tunneling tools as part of its operational toolkit, adding that this approach allows attackers to bypass network controls, maintain covert access to compromised environments, and make detection considerably more difficult. Given the long-running and sophisticated nature of these techniques, he said, organizations and security teams need to incorporate these findings into their threat assessments and strengthen their detection and response capabilities.
