An espionage crew that specializes in aerospace, aviation, defense and telecommunications has quietly rebuilt its toolkit, and researchers at Kaspersky have now found the new malware sitting on victim machines from Egypt to Ethiopia.
The group is tracked as Mirage Kitten, and elsewhere as UNC1549, Smoke Sandstorm and Nimbus Manticore. It is known for highly targeted spear phishing, fake recruitment portals impersonating trusted employers, and lookalike videoconferencing pages that push victims toward malicious archives on file sharing services. Kaspersky researchers Omar Amin and Vasily Berdnikov documented three tools that had not been publicly described before: a Windows backdoor they named NightLedger, and two tunneling tools called ArcBridge and BridgeHead.
What the new tools do
NightLedger is the workhorse. It poses as a legitimate Windows library called SspiCli.dll and gets loaded through DLL search order hijacking, a technique where malware is planted alongside a trusted program so the program loads the attacker file instead of the real one. Once running it checks in over HTTPS to realhealthshop[.]com, with tjconsultingservices[.]com as a backup, and accepts around 20 commands: run a program, list folders and drives, copy or delete files, take a screenshot, load a DLL, kill a process, and upload stolen files back to the operators. One command specifically collects NetSetup.log, a Windows diagnostic file that records domain join activity and gives an intruder a fast read on how the network is put together.
BridgeHead is the more interesting piece of tradecraft. Kaspersky found it deployed as unbcl.dll inside a Visual Studio folder on a machine in Egypt, and as libwinpthread-1.dll at a Pakistan based aerospace and aviation organization. Before doing anything, it reads the logged in Windows username and looks for a specific string inside it. If the name does not match, the malware exits silently. That single check does two jobs: it confirms the operators had already mapped the network and knew exactly which machine they wanted, and it keeps the sample inert inside security sandboxes.
When the check passes, BridgeHead opens an encrypted WebSocket connection and turns the victim machine into a full tunnel. The operators run their tools on their own servers, and the resulting traffic emerges from inside the victim network as though a legitimate employee generated it. The tool is also built for corporate environments specifically: if a company proxy demands authentication, it negotiates using the logged in user's own Windows credentials, preferring Negotiate over NTLM. ArcBridge, first seen in April 2026, does much the same job with a hardcoded configuration pointing at aecert[.]org.
Who is being hit
Kaspersky telemetry places victims across the Middle East and Africa: organizations in Egypt, small business and government environments in Jordan and Tanzania, aviation companies in Pakistan, telecommunications firms in Ethiopia, and financial sector entities in Burkina Faso. That African spread is a notable widening for a group previously associated with the Middle East and Europe.
Kaspersky does not name a state sponsor in this report. The group's alternate names do sit in the naming families that Microsoft ("Sandstorm") and Check Point ("Manticore") reserve for Iran linked operations, and the same actor's earlier MiniUpdate tooling featured in our coverage of six new spying trojans aimed at defense firms. Kaspersky also notes the group is drifting away from Microsoft Azure subdomains toward Cloudflare backed domains, likely to make attribution harder.
What you should do
Defenders in the affected sectors should hunt for the named files in unusual locations, especially unbcl.dll under a user AppData Visual Studio path and libwinpthread-1.dll outside a real toolchain install. Watch for outbound WebSocket upgrades to cloud hosted domains from workstations that have no reason to make them, and treat unexpected proxy authentication from a background process as suspicious. The single instance mutexes A8215357-F99A-44FE-BC65-D8F0434B0C03 and F56E68DA-4A89-46B4-9AC8-7290A7651000 are reliable host based checks.
Selected indicators (defanged): realhealthshop[.]com, tjconsultingservices[.]com, aecert[.]org, smartconnect[.]azurewebsites[.]net, businessmixture[.]com and 172[.]86[.]98[.]113. Hashes and the full infrastructure list are in the original report.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.