MirageMalware
Last reported 9 days ago, by AhnLab ASEC7 reports
ATT&CK techniques
6 of 10 · each with the sentence it comes from- T1053.005Scheduled Task
“Callisto deployed CosmicPulse using RedFlick (a scheduled task-based delivery technique), while UAC-0099 attempted to disrupt AI analysis using GuardBreaker (an LLM-based obfuscation technique).”
- T1027.017SVG Smuggling
“SVG smuggling campaign: Kaseya's INKY team has spotted a massive email spam campaign using SVG smuggling to assemble a phishing page right in the user's browser.”
- T1036Masquerading
“Masquerading as the Windows terminal server SDK DLL (wtsapi32.dll), this backdoor forward-exports all legitimate SDK functions.”
- T1056.001Keylogging
“Researchers developed a static deobfuscation pipeline that recovered readable code, revealing keylogging, browser credential theft, HTTPS interception, additional encryption, and newer variants targeting macOS systems.”
- T1110.003Password Spraying
“AWS password spraying campaign: A password spraying campaign has targeted the root user accounts of AWS tenants.”
- T1195Supply Chain Compromise
“The group is known for its use of supply chain compromises, watering hole attacks, fake recruitment websites, and custom backdoors, and has been linked to operations supporting Iran’s Islamic Revolutionary Guard Corps (IRGC).”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
7 reports, newest first · the exact sentence from each-
September 2026 Threat Trend Report on APT Groups“Mirage Kitten used NodeRabbit and PollCat to target developer workstations in the aviation, aerospace, and fintech sectors.”
-
7th September – Threat Intelligence Report“Researchers have mapped a campaign by Iran-linked Mirage Kitten that uses fake LinkedIn coding tests to deliver NodeRabbit and PollCat malware.”
-
Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates“Mirage Kitten targets fintech with new malware: Iranian APT group Mirage Kitten is using two previously undocumented RATs named NodeRabbit and PollCat in a campaign targeting fintech and aviation companies across Africa and the Middle East.”
-
Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set“Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set”
-
Tortoiseshell Expands Malware Toolset With New Backdoor, SSH Tunnel“… a technical write-up published on August 26, Group-IB said the cyber-espionage group, which it tracks as Tortoiseshell and Kaspersky as Mirage Kitten, has been active since at least 2018 and has primarily targeted defense, aerospace, IT service providers and military organizatio…”
-
Tortoiseshell: New Toolset and Operational Infrastructure Exposed“Group-IB tracks this group as Tortoiseshell (also known as Mirage Kitten, UNC1549, and Nimbus Manticore), an Iranian-nexus threat actor affiliated with IRGC.”
-
Navigating Cybercrime Currents in Latin America: Strengthening the Region’s Defenses“From The Shores of Brazil: A Loan Mirage”
Indicators in its reports
named in the reports above- locat[.]sbsin 2 reports
- tiktok-u[.]sbsin 2 reports
- 1ea83e4e4592b01e4acab63eb867bee5in 1 report
- hxxps://oracle-challenge.s3.us-east-1.amazonaws[.]com/Front-Technical-Challenge.zipin 1 report
- oracle-challenge.s3.us-east-1.amazonaws[.]comin 1 report
- hxxps://plugplay.azurewebsites[.]netin 1 report
- plugplay.azurewebsites[.]netin 1 report
- hxxps://rgbteller.azurewebsites[.]netin 1 report
- rgbteller.azurewebsites[.]netin 1 report
- hxxps://wslwebui.azurewebsites[.]netin 1 report
- wslwebui.azurewebsites[.]netin 1 report
- hxxps://visitfinancedentists[.]comin 1 report
- visitfinancedentists[.]comin 1 report
- hxxps://kyrasey-f8hfexa5cqamh7fk.westeurope-01.azurewebsites[.]netin 1 report
- kyrasey-f8hfexa5cqamh7fk.westeurope-01.azurewebsites[.]netin 1 report
- hxxps://healthcomfsdpower[.]comin 1 report
- healthcomfsdpower[.]comin 1 report
- hxxps://lifespotify[.]com/api/users/b879746e-fed9-4211-a6da-4d8223681267/otp/validatein 1 report
- lifespotify[.]comin 1 report
- hxxps://sahi-finance[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.