Loading malware…
BridgeHead is a custom Windows WebSocket tunneling tool used by the Iranian-aligned cyberespionage group Mirage Kitten, also tracked as UNC1549, Smoke Sandstorm, and Nimbus Manticore. Deployed during post-exploitation, it functions as a full SOCKS5 tunnel proxy, providing covert, operator-controlled network access through compromised systems. It has been observed in victim environments in Egypt and at a Pakistan-based aerospace and aviation organization, alongside the actor’s broader use of the NightLedger backdoor and ArcBridge tunneler.
BridgeHead establishes an encrypted WebSocket connection to command-and-control infrastructure and receives binary commands directing tunnel connections. It relays TCP traffic between operator-specified destinations and the WebSocket channel, making connections appear to originate from the victim network. To operate behind enterprise proxies, it supports authentication using the current user’s Windows single sign-on context, preferring Negotiate over NTLM.
Known variants restrict activation by checking the current Windows username against a hardcoded substring. This victim-specific execution control limits operation to intended environments and hinders automated analysis. Observed deployments followed targeted spearphishing activity involving recruitment-themed impersonation and lookalike videoconferencing pages that redirected victims to malicious archives.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Also weaponized by Variston is a high-severity security shortcoming in Qualcomm chips (CVE-2023-33063) that first came to light in October 2023.
Unknown state-sponsored actors exploited CVE-2023-28205, CVE-2023-28206, and CVE-2023-32409 as zero-days to infect victims with spyware developed by Variston.
Unknown state-sponsored actors exploited CVE-2023-28205, CVE-2023-28206, and CVE-2023-32409 as zero-days to infect victims with spyware developed by Variston.
Unknown state-sponsored actors exploited CVE-2023-28205, CVE-2023-28206, and CVE-2023-32409 as zero-days to infect victims with spyware developed by Variston.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Kaspersky documented the NightLedger backdoor and ArcBridge and BridgeHead tunneling tools in July 2026.
BridgeHead is listed as one of two custom WebSocket tunnelers in Nimbus Manticore's expanded arsenal.
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Mirage Kitten continues to rely on highly targeted spear-phishing, recruitment-themed lures, and fake videoconferencing pages to gain initial access before deploying custom malware.
The phishing activity employed carefully crafted recruitment-themed lures impersonating trusted employers and hiring platforms, alongside lookalike videoconferencing websites that redirected victims to malicious archives hosted on third-party file-sharing services.
The malware dynamically loads advapi32.dll, resolves GetUserNameA ... Notably ... another variant ... shares the same dynamic-resolve stub pattern.
The malware provides remote access, command execution, file management, and covert communication to maintain persistence and evade detection.
NightLedger periodically contacts its C2 over HTTPS ... establishes an HTTPS WebSocket connection ... communicates with businessmixture.com/blog over WSS on port 443
Kaspersky also identified BridgeHead, a custom WebSocket tunneling utility deployed during post-exploitation activity. The malware functions as a full SOCKS5 tunnel proxy, forwarding attacker-controlled traffic through compromised systems...
22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A tunneling tool previously documented in connection with Mirage Kitten activity; no functional details are provided in this reference.
Custom WebSocket tunneling tool attributed to Nimbus Manticore; no further functionality is described.
A custom WebSocket tunneling tool used to help maintain persistent access to compromised systems.
Custom WebSocket tunneling utility used to support persistent access.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.