Loading malware…
ArcBridge is a custom WebSocket-based tunneling utility used by the Iranian-aligned cyber-espionage actor Mirage Kitten, also tracked as Nimbus Manticore, UNC1549, and Smoke Sandstorm. First identified in April 2026, it enables operators to establish remote proxy or tunnel sessions through compromised systems and perform DNS resolution from those environments. ArcBridge uses embedded communications configuration and single-instance execution controls, supporting covert post-compromise access and operator routing through victim networks. It has been observed in activity targeting organizations in the Middle East and forms part of a bespoke Mirage Kitten toolset alongside the NightLedger backdoor and BridgeHead tunneler. The associated espionage activity has targeted organizations across the Middle East, Africa, and South Asia, including aerospace, aviation, telecommunications, government, and financial-sector entities.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Kaspersky documented the NightLedger backdoor and ArcBridge and BridgeHead tunneling tools in July 2026.
ArcBridge is listed as one of two custom WebSocket tunnelers in Nimbus Manticore's expanded arsenal.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
Mirage Kitten continues to rely on highly targeted spear-phishing, recruitment-themed lures, and fake videoconferencing pages to gain initial access before deploying custom malware.
Like NightLedger, ArcBridge employs a unique mutex to prevent multiple instances...
The malware provides remote access, command execution, file management, and covert communication to maintain persistence and evade detection.
NightLedger periodically contacts its C2 over HTTPS ... establishes an HTTPS WebSocket connection ... communicates with businessmixture.com/blog over WSS on port 443
Kaspersky also identified BridgeHead, a custom WebSocket tunneling utility deployed during post-exploitation activity. The malware functions as a full SOCKS5 tunnel proxy, forwarding attacker-controlled traffic through compromised systems...
Once the WebSocket channel is established and authenticated, the implant functions as a full SOCKS5 tunnel proxy ... all resulting TCP traffic is tunneled through the victim’s machine as if originating from the victim’s network.
The utility enables operators to establish remote proxy sessions and perform DNS resolution through compromised hosts...
21 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.