A new wave of espionage activity has been detected attributed to the advanced persistent threat (APT) group Mirage Kitten (also tracked as UNC1549, Smoke Sandstorm, and Nimbus Manticore). This campaign specifically targets critical infrastructure sectors—Aerospace, Defense, Telecommunications, and Government—within the Middle East and Africa (MEA) region.

The adversary has deployed a sophisticated, previously undocumented malware ecosystem designed for long-term surveillance and data exfiltration. The primary payload, NightLedger, serves as a full-featured Windows backdoor, supported by a suite of auxiliary tools including BridgeHead, ArcBridge, TWOSTROKE, Retrograde, and others. The campaign leverages older vulnerabilities (CVE-2019-0859, CVE-2019-0797), suggesting a focus on unpatched legacy systems or initial access brokers utilizing known exploits.

Threat Actor / Malware Profile

Adversary: Mirage Kitten (UNC1549)

Mirage Kitten is a nation-state aligned group with a history of strategic intelligence gathering. Their recent evolution shows a shift towards a modular malware architecture.

Malware Families

NightLedger: The primary Windows backdoor. It provides comprehensive capabilities including:
- Reconnaissance: System profiling and environment discovery.
- Command Execution: Running shell commands or arbitrary binaries.
- File Operations: Uploading, downloading, and modifying files.
- Process Operations: Spawning and manipulating processes (likely for injection or defense evasion).
BridgeHead & ArcBridge: Likely network bridges or proxy tools used to tunnel traffic to C2 servers through victim infrastructure.
TWOSTROKE / Retrograde: Likely auxiliary components for persistence, anti-analysis, or data staging.
POLLBLEND: Potentially a custom communication protocol or scheduling mechanism for C2 check-ins.

Distribution & Persistence

Initial Access: Exploitation of CVE-2019-0859 (Windows Win32k Elevation of Privilege) and CVE-2019-0797 (Windows Local Security Authority Subsystem Service) suggests an initial compromise vector followed by privilege escalation.
C2 Communication: Communications are routed through benign-looking domains (e.g., neexportfolio.com, buisness-centeral-transportation.com) to blend in with corporate traffic.

IOC Analysis

The provided indicators of compromise (IOCs) consist of 2 CVEs and a mix of suspicious domains and a file hash.

CVEs (CVE-2019-0859, CVE-2019-0797): These are critical vulnerabilities from 2019. Their presence indicates the actor is exploiting unpatched legacy Windows environments. SOC teams should focus on vulnerability scanning for these specific CVEs in the targeted regions.
Domains: 5 domains were identified. These act as C2 infrastructure. They should be blocked at the perimeter and proxy level.
File Hash (MD5): 42f847597109da2a220391bb09d00676. This specific hash should be added to EDR blocklists and used to scan historical file logs.

Operationalization: Immediate ingestion of these domains into DNS fireholes and EDR network telemetry alerts is required.

Detection Engineering

Sigma Rules

YAML

title: Mirage Kitten NightLedger C2 Activity
id: 7a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
description: Detects network connections to known Mirage Kitten C2 domains associated with the NightLedger campaign.
status: experimental
author: Security Arsenal
date: 2026/07/28
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
detection:
  selection:
    dst_domain:
      - 'neexportfolio.com'
      - 'buisness-centeral-transportation.com'
      - 'healthcarezoomcenteral.org'
      - 'tjconsultingservices.com'
      - 'realhealthshop.com'
  condition: selection
falsepositives:
  - Unknown
level: critical
---
title: Potential Exploitation CVE-2019-0859 or CVE-2019-0797
id: 8b4c3d2e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
description: Detects suspicious process activity often associated with the exploitation of Win32k or LSASS vulnerabilities used by Mirage Kitten for privilege escalation.
status: experimental
author: Security Arsenal
date: 2026/07/28
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '\rundll32.exe'
      - '\powershell.exe'
    CommandLine|contains:
      - 'comsvcs.dll'
      - 'MiniDump'
  condition: selection
falsepositives:
  - Legitimate debugging or memory dumps (rare)
level: high
---
title: NightLedger Malware File Hash Detection
id: 9c5d4e3f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
description: Detects the execution of files matching the known NightLedger MD5 hash.
status: experimental
author: Security Arsenal
date: 2026/07/28
tags:
  - attack.execution
logsource:
  category: file_event
detection:
  selection:
    TargetFilename|contains: '.exe' 
    MD5|hash: '42f847597109da2a220391bb09d00676'
  condition: selection
falsepositives:
  - None
level: critical

KQL (Microsoft Sentinel)

KQL — Microsoft Sentinel / Defender

// Hunt for Mirage Kitten C2 Traffic
DeviceNetworkEvents
| where RemoteUrl in (
    'neexportfolio.com', 
    'buisness-centeral-transportation.com', 
    'healthcarezoomcenteral.org', 
    'tjconsultingservices.com', 
    'realhealthshop.com'
)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, ActionType
| extend Timestamp = format_datetime(Timestamp, 'yyyy-MM-dd HH:mm:ss')
| order by Timestamp desc
;
// Hunt for Known Malicious File Hash
DeviceFileEvents
| where SHA1 == "42f847597109da2a220391bb09d00676" or MD5 == "42f847597109da2a220391bb09d00676" 
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessAccountName, SHA1, MD5
| order by Timestamp desc

PowerShell Hunt Script

PowerShell

<#
.SYNOPSIS
    IOC Hunter for Mirage Kitten / NightLedger Campaign
.DESCRIPTION
    Scans DNS cache, running processes, and recent files for Mirage Kitten indicators.
#>

$MaliciousHash = "42f847597109da2a220391bb09d00676"
$C2Domains = @(
    "neexportfolio.com",
    "buisness-centeral-transportation.com",
    "healthcarezoomcenteral.org",
    "tjconsultingservices.com",
    "realhealthshop.com"
)

Write-Host "[+] Checking DNS Cache for C2 Domains..."
$DnsCache = Get-DnsClientCache
foreach ($Domain in $C2Domains) {
    if ($DnsCache | Where-Object { $_.Entry -like "*$Domain*" }) {
        Write-Host "[!] ALERT: Found DNS entry for $Domain" -ForegroundColor Red
    }
}

Write-Host "[+] Scanning processes for malicious hash (MD5)..."
$Processes = Get-Process -IncludeUserName
foreach ($Proc in $Processes) {
    try {
        $FilePath = $Proc.Path
        if ($FilePath -and (Test-Path $FilePath)) {
            $FileHash = (Get-FileHash -Path $FilePath -Algorithm MD5).Hash
            if ($FileHash -eq $MaliciousHash) {
                Write-Host "[!] ALERT: Malicious process found: $($Proc.ProcessName) (PID: $($Proc.Id))" -ForegroundColor Red
            }
        }
    } catch {
        # Ignore access errors
    }
}

Write-Host "[+] Scan complete."


# Response Priorities

*   **Immediate**:
    *   Block all listed domains on network perimeter devices (Firewalls, Proxies) and DNS servers.
    *   Initiate a hunt for the MD5 hash `42f847597109da2a220391bb09d00676` across all endpoints using EDR historical data.
*   **24h**:
    *   Identify and isolate any hosts communicating with the C2 infrastructure.
    *   Review authentication logs for anomalous activity on accounts associated with compromised hosts.
*   **1 Week**:
    *   Conduct a vulnerability assessment specifically for CVE-2019-0859 and CVE-2019-0797 across the enterprise, prioritizing legacy systems.
    *   Implement network segmentation to restrict lateral movement from internet-facing systems to critical aerospace/defense networks.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

Mirage Kitten Campaign: NightLedger Backdoor & ArcBridge Toolset Analysis