IranAssessedIRGC-affiliatedEspionageActive 2021 – 2026Mirage Kitten
Also known asUNC1549 · Smoke Sandstorm · Nimbus Manticore · Screening Serpens · TA455 · COBALT SMOKEY
Summary
Iran-nexus espionage group targeting aviation, aerospace, defence and FinTech organisations across the Middle East and Africa (Kaspersky GReAT: Mirage Kitten; Mandiant: UNC1549; Microsoft: Smoke Sandstorm; Check Point: Nimbus Manticore; PRODAFT: Subtle Snail — a cluster Check Point treats as separate). Defining tradecraft is fake-recruitment social engineering: operators run recruiter personas on LinkedIn and job platforms, then deliver trojanized "coding challenge" archives from legitimate cloud storage (Amazon S3, previously onlyoffice.com). Lures are working Express/React/Vite applications whose README imposes a short time limit and explicitly prohibits AI assistants — which conveniently prevents an AI code review from flagging the single altered source file. Malicious npm packages (colorized_terminal, pretty-log, both pinned to 2.1.0) ship bundled inside node_modules rather than published to the registry, so the implant executes on first import. Through mid-2026 the group shifted from native C/C++/Go malware deployed via DLL search-order hijacking to cross-platform Node.js and JavaScript implants (NodeRabbit, PollCat) that run on Windows, Linux and macOS from one codebase and blend into developer workstations. C2 runs through Azure Websites subdomains and Cloudflare-fronted domains; in some intrusions operators embedded the victim organisation’s own name in the Azure subdomain so beacons resembled ordinary corporate traffic. Kaspersky attributes NodeRabbit and PollCat with high confidence on shared C2 handshake logic, identical beacon timing constants and overlapping command identifiers with the group’s earlier Retrograde/MiniFast backdoor.
Attribution
No government attribution on record
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- MITRE ATT&CK (MITRE ATT&CK, 2026-10)
State-sponsored group associated with the IRGC
Campaigns 7
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| NightLedger / BridgeHead intrusions | 2026-04 – 2026 | Egypt, Pakistan, Middle East | Aerospace, Aviation | Kaspersky GReAT (2026-07-28) |
| 2026 wartime waves — AppDomain hijacking, Zoom-installer lure, SEO-poisoned SQL Developer site (MiniFast) | 2026-02 – 2026-04 | Saudi Arabia, Australia, USA, Israel, UAE, Europe | Aviation, Software Development, Aerospace | Check Point Research (2026-05-22) |
| Screening Serpens 2026 waves (MiniUpdate / MiniJunk V2)ASSESSED | 2026-02 – 2026-04 | USA, Israel, UAE, Middle East | Technology, Aerospace, Defense, Telecommunications | Unit 42 (2026-05-22) |
| Fake Coding Challenge Recruitment | 2026 – ongoing | Egypt, Ethiopia, Afghanistan | Aviation, Aerospace, FinTech | Kaspersky GReAT (2026-09-01) |
| Nimbus Manticore — European telecom/defence recruitment lures | 2025 – ongoing | Denmark, Sweden, Portugal, Israel, UAE | Defense, Telecommunications, Aviation | Check Point Research (2025-09-22) |
| PRODAFT 'Subtle Snail' — telecom intrusions via recruitment lures (34 devices, 11 organisations)ASSESSED | 2025 | Canada, France, UAE, UK, USA | Telecommunications | PRODAFT, via The Hacker News (2025-09-19) |
| Aerospace & defence supply-chain intrusions (third-party pivots, VDI breakout) | 2023 – 2025 | Middle East | Aerospace, Aviation, Defense | Mandiant (2025-11-17) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 34
Malware and tools 18
| Name | Description | Platform |
|---|---|---|
| NodeRabbit | Cross-platform Node.js RAT; 11–23 commands, AES-256-GCM C2, sandbox checks, corporate proxy tunnelling, VS Code extension and Git hook persistence | Windows/Linux/macOS |
| PollCat | Obfuscated JavaScript RAT launched from a trojanized React challenge before OTP auth completes; 22 commands over a binary protocol, treats HTTP 400 as a successful handshake | Windows/Linux/macOS |
| NightLedger | Backdoor documented in the July 2026 toolset | Windows |
| ArcBridge | Tunnelling tool used for network pivoting | Windows |
| BridgeHead | Tunnelling tool used for network pivoting | Windows |
| MiniFast/Retrograde | Native DLL backdoor sharing C2 handshake, beacon timing and command IDs with PollCat | Windows |
| TWOSTROKE | C++ backdoor, SSL over TCP/443 | Windows |
| DEEPROOT | Golang backdoor | Linux |
| LIGHTRAIL | Tunneler over Azure infrastructure (Lastenzug-based) | Windows |
| GHOSTLINE | Golang tunneler (go-yamux) | Windows |
| POLLBLEND | C++ tunneler | Windows |
| DCSYNCER.SLICK | DCSync credential tool (Mimikatz-based) | Windows |
| SIGHTGRAB | Screenshot capture tool | Windows |
| TRUSTTRAP | Fake credential prompt | Windows |
| CRASHPAD | Credential decryptor (CryptUnprotectData) | Windows |
| MINIBIKE/MiniJunk | C++ backdoor loaded by DLL side-loading | Windows |
| MiniBrowse | Browser credential stealer | Windows |
| MiniBus | Malware | Windows |
Infrastructure patterns
- Azure Web App subdomains as C2, some carrying the target organisation's name (Kaspersky, 2026)
- Cloudflare-fronted, often career-themed domains, some registered through NameCheap (Check Point, 2025; Kaspersky, 2026)
- Amazon S3 buckets host the initial ZIP lures (Kaspersky, 2026)
- Trojanized npm packages bundled in the lure's node_modules, never published to npm (Kaspersky, 2026)
Reporting and advisories 8
- Kaspersky GReAT
Fake Coding Challenge Recruitment - Kaspersky GReAT
NightLedger / BridgeHead intrusions - Mandiant
Aerospace & defence supply-chain intrusions (third-party pivots, VDI breakout) - Check Point Research
Nimbus Manticore — European telecom/defence recruitment lures - Unit 42
Screening Serpens 2026 waves (MiniUpdate / MiniJunk V2) - Check Point Research
2026 wartime waves — AppDomain hijacking, Zoom-installer lure, SEO-poisoned SQL Developer site (MiniFast) - PRODAFT
Modus Operandi of Subtle Snail (UNC1549) — 34 devices across 11 organisations via fake recruitment - MITRE ATT&CK
Mirage Kitten (G1059) group profile