BridgeHead DLL masquerading as unbcl.dll or libwinpthread-1.dll in atypical directories

Ethan Andrews@eandrews

•updated Jul 28, 2026•0•0•4

Detects the presence of BridgeHead tunneler binaries disguised as legitimate library files ('unbcl.dll' or 'libwinpthread-1.dll') within non-standard directories, a behavior associated with Mirage Kitten intrusions.