Islamabad (GNP): Kaspersky’s Global Research and Analysis Team (GReAT) has identified a previously undocumented malware toolset linked to the threat group Mirage Kitten, with victims including aviation organizations in Pakistan among others.
According to researchers, the malicious tools were deployed in a targeted campaign aimed at maintaining long-term access to compromised networks and stealing sensitive data. Victims identified across the campaign span the Middle East and Africa, including organizations in Egypt, small and medium-sized businesses and government bodies in Jordan and Tanzania, telecom companies in Ethiopia, and financial institutions in Burkina Faso.
Toolset Details
The malware set consists of three custom tools. At its core is NightLedger, a newly identified Windows backdoor attributed to the group based on similarities to its previously known malware. The backdoor gives attackers remote access to infected systems, allowing them to execute commands, browse and transfer files, and capture screenshots.
Two additional tools, ArcBridge and BridgeHead, function as covert tunneling utilities, effectively turning compromised machines into relay points. This allows attackers to route traffic through victim systems as though it originated internally, helping them evade network defenses and maintain long-term, low-visibility access. The first of these tools was identified in April 2026 during activity targeting victims in the Middle East.
Attack Pattern in Pakistan
While the initial method of compromise remains unclear in most cases, Kaspersky researchers observed BridgeHead being used during post-compromise activity at organizations in Egypt and at an aerospace and aviation organization in Pakistan. In these instances, the intrusions followed spear-phishing attempts consistent with the group’s known tactics, using highly tailored lures such as fake recruitment messages impersonating trusted brands and hiring platforms, as well as fraudulent video conferencing pages redirecting victims to malicious files hosted on third-party file-sharing sites.
Kaspersky GReAT senior security researcher Omar Amin said the findings indicate that Mirage Kitten continues to refine its malware capabilities in support of espionage-focused operations across the Middle East and Africa. He noted the group’s continued use of tunneling tools as a notable aspect of the campaign, allowing attackers to bypass network security controls and maintain hidden access while complicating detection efforts. He recommended that organizations factor these findings into their threat assessments and strengthen detection and response capabilities accordingly.
Further technical details are available on Securelist.com.
Recommended Protections
To defend against Mirage Kitten and similar threats, Kaspersky advises organizations to remain vigilant against the specific tools identified — NightLedger, ArcBridge, and BridgeHead — and to deploy comprehensive security solutions offering real-time protection, threat visibility, and EDR/XDR-level investigation and response capabilities, such as those in the Kaspersky Next product line.
Also read: MDCAT Rescheduled to September 20, 2026
The company also recommends organizations consider managed security services, including compromise assessments, managed detection and response, and incident response support, to help address evasive attacks and supplement in-house cybersecurity expertise. Additionally, Kaspersky suggests equipping security teams with threat intelligence tools to maintain visibility into emerging cyber risks throughout the incident management process.
Sohail Majeed is a Special Correspondent at The Diplomatic Insight. He has twelve plus years of experience in journalism & reporting. He covers International Affairs, Diplomacy, UN, Sports, Climate Change, Economy, Technology, and Health.
