Mirage Kitten Targets MEA Region With New Malware

Mirage Kitten, also known as UNC1549, Smoke Sandstorm, and Nimbus Manticore, has expanded its malware arsenal with a previously undocumented set of tools identified in April 2026. The campaign primarily targets critical sectors including aerospace, aviation, defense, and telecommunications across the Middle East and Africa, with confirmed victims in Egypt, Jordan, Pakistan, Ethiopia, and Burkina Faso.

The newly discovered toolset consists of NightLedger, a reconnaissance-focused Windows backdoor, and two custom WebSocket-based tunnelers, ArcBridge and BridgeHead. These tools demonstrate sophisticated evasion techniques, including DLL search-order hijacking and per-target username verification to prevent execution in sandbox environments. The actor is shifting infrastructure from Microsoft Azure subdomains to Cloudflare-backed domains to complicate attribution.

This activity represents a significant threat to regional critical infrastructure, as the group leverages highly tailored social engineering lures and custom tunneling utilities to maintain covert network persistence and exfiltrate sensitive data. Organizations in the targeted sectors should prioritize monitoring for the specific indicators and behaviors associated with these custom implants.