Loading malware…
NightLedger is a Windows backdoor attributed to the Iranian-aligned cyber-espionage actor Mirage Kitten, also tracked as Nimbus Manticore, UNC1549, and Smoke Sandstorm. It is used in operations targeting organizations in the Middle East, Africa, and South Asia, including aerospace, aviation, defense, telecommunications, government, financial-sector, and small-business entities. NightLedger masquerades as a legitimate Windows component and executes through DLL search-order hijacking. It communicates with command-and-control infrastructure over HTTPS and supports host and user reconnaissance, directory and logical-drive enumeration, process listing and management, process execution, DLL loading, file download, upload, copying, and deletion, screenshot capture, and collection of Windows diagnostic logs. Its command protocol and development characteristics overlap with the actor's previously observed TWOSTROKE backdoor. NightLedger has been used alongside the BridgeHead and ArcBridge tunneling utilities to support covert, long-term access to compromised environments.
5 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Kaspersky documented the NightLedger backdoor and ArcBridge and BridgeHead tunneling tools in July 2026.
The article lists "a Windows backdoor called NightLedger" among Nimbus Manticore's recently expanded malware arsenal.
Recent findings also detail the use of a new backdoor called NightLedger and custom WebSocket tunnelers by the group, targeting entities in the Middle East, Africa, and South Asia.
Recent findings also detail the use of a new backdoor called NightLedger and custom WebSocket tunnelers by the group, targeting entities in the Middle East, Africa, and South Asia.
Recent findings also detail the use of a new backdoor called NightLedger and custom WebSocket tunnelers by the group, targeting entities in the Middle East, Africa, and South Asia.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Mirage Kitten continues to rely on highly targeted spear-phishing, recruitment-themed lures, and fake videoconferencing pages to gain initial access before deploying custom malware.
The campaign introduces three previously undocumented malware families, NightLedger, BridgeHead, and ArcBridge, that provide reconnaissance, command execution, covert tunneling, and persistent post-compromise access capabilities.
The implant masquerades as SspiCli.dll and abuses DLL search-order hijacking to execute alongside the legitimate Windows binary AppVShNotify.exe.
43 Load a DLL
The implant masquerades as SspiCli.dll and abuses DLL search-order hijacking to execute alongside the legitimate Windows binary AppVShNotify.exe.
43 Load a DLL
This allows a co-located malicious SspiCli.dll to be loaded while forwarding expected exports to the legitimate DLL.
The implant masquerades as SspiCli.dll and abuses DLL search-order hijacking to execute alongside the legitimate Windows binary AppVShNotify.exe.
Command ID Description 1 Gather user and host identity information
Once loaded, NightLedger contacts its C2 infrastructure over HTTPS and supports a broad range of post-compromise activities including... process management...
Once loaded, NightLedger contacts its C2 infrastructure over HTTPS and supports a broad range of post-compromise activities including system reconnaissance...
Once loaded, NightLedger contacts its C2 infrastructure over HTTPS and supports a broad range of post-compromise activities including... directory enumeration...
Command ID Description 93 Collect C:\Windows\debug\NetSetup.log together with process-list output. NetSetup.log is a Windows diagnostic log generated ... during domain/workgroup join, unjoin, and related network setup operations.
93 Collect C:\Windows\debug\NetSetup.log together with process-list output.
Once loaded, NightLedger contacts its C2 infrastructure over HTTPS and supports a broad range of post-compromise activities including... screenshot capture...
The malware provides remote access, command execution, file management, and covert communication to maintain persistence and evade detection.
“Recent findings also detail the use of ... custom WebSocket tunnelers by the group.”
Once loaded, NightLedger contacts its C2 infrastructure over HTTPS and supports a broad range of post-compromise activities including... file upload and download...
“Nimbus Manticore ... has been observed using an SSH-based tunneling utility” and “custom WebSocket tunnelers.”
Upload file to the command-and-control (C2) server via an HTTP POST request
23 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.