Loading threat actor…
Mirage Kitten, also tracked as UNC1549, Smoke Sandstorm, and Nimbus Manticore, is an Iranian state-backed cyberespionage group active since at least 2022. It conducts long-term intelligence collection against aerospace, aviation, defense, telecommunications, financial services, and government organizations across the Middle East, Africa, and Europe. Confirmed victim environments include Egypt, Ethiopia, Afghanistan, Pakistan, Jordan, Tanzania, and Burkina Faso. The group uses highly targeted spear-phishing, recruiter impersonation, fraudulent recruitment portals, and lookalike videoconferencing pages to deliver malicious archives. It also targets software engineers through fake recruiter accounts on LinkedIn and other employment platforms, distributing trojanized coding assessments with malicious dependencies bundled inside otherwise legitimate-looking development projects. These assessments deliver NodeRabbit and PollCat, cross-platform Node.js and JavaScript remote-access trojans supporting Windows, Linux, and macOS. Their capabilities include command execution, host and network reconnaissance, process management, file collection and transfer, and persistent remote access. Persistence mechanisms include scheduled tasks, cron jobs, macOS LaunchAgents, Windows startup mechanisms, counterfeit Visual Studio Code extensions, and modified Git hooks. NodeRabbit variants additionally incorporate sandbox checks, authenticated enterprise-proxy support, encrypted command-and-control communications, and discovery of development projects and Outlook artifacts. Mirage Kitten's native malware toolkit includes Retrograde, also known as MiniFast, TWOSTROKE, and the NightLedger Windows backdoor. NightLedger uses DLL search-order hijacking and supports reconnaissance, screenshot capture, command execution, and file upload and download. The group's BridgeHead and ArcBridge WebSocket tunneling utilities provide covert operator-controlled network access through compromised systems; BridgeHead supports SOCKS5 traffic relay, enterprise single-sign-on proxy authentication, and victim-specific username checks. Mirage Kitten uses legitimate cloud infrastructure, including Microsoft Azure and Cloudflare-backed services, alongside custom tooling, masquerading, and anti-analysis controls to sustain access and evade detection.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
62 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
12 malware families Mallory has associated with this actor across public reporting.
7 additional families tracked in Mallory.
158 indicators attributed to this actor. Values are masked here and available in full in Mallory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.