A fresh wave of Iranian state-sponsored espionage hit government agencies, ations across six countries last week — and the attackers used three Windows tools that no security researcher had ever documented before
Kaspersky’s Global Research and Analysis Team (GReAT) disclosed the campaign on July 28, 2026, attributing it to the threat actor the firm tracks as Mirage Kitten, detailed in Kaspersky’s full disclosure report. Other vendors follow the same group under different names: Nimbus Manticore (Check Point Research), UNC1549 (Mandiant/Google), Smoke Sandstorm (Microsoft), TA455 (Proofpoint), Subtle Snail (PRODAFT), and Screening Serpens (Unit 42). The group is widely assessed to operate on behalf of Iran’s Islamic Revolutionary Guard Corps. The three newly documented tools — a backdoor named NightLedger and two WebSocket-based network tunneling tools named BridgeHead and ArcBridge — have not appeared in prior threat intelligence reporting from any major vendor.
Kaspersky’s telemetry placed confirmed victims in Egypt, government and small-business environments in Jordan and Tanzania, aviation organizations in Pakistan, telecommunications companies in Ethiopia, and financial-sector entities in Burkina Faso, according to the Kaspersky Securelist report. The geographic spread — spanning the Arabian Peninsula, East Africa, South Asia, and West Africa — marks a documented expansion of the group’s operational reach beyond its historically Middle East-centric focus.
The three newly documented tools are not interchangeable additions to a standard toolkit. NightLedger provides persistent remote access and reconnaissance. BridgeHead and ArcBridge convert compromised machines into relay nodes, laundering subsequent attacker traffic through the victim’s own IP space in ways that defeat conventional network-level detection. Together, the toolset reflects an operational architecture designed to be difficult to find, difficult to trace, and difficult to remove once established.
NightLedger Hides as a Windows System DLL, Then Phones Home Over HTTPS
NightLedger arrives disguised as SspiCli.dll, a Windows authentication library, and exploits a specific quirk in how Microsoft’s application virtualization client initializes, as analyzed in Kaspersky’s technical breakdown. The target binary is AppVShNotify.exe, a legitimate Windows component. That executable does not directly import SspiCli.dll — but it does import RPCRT4.dll, the Windows RPC runtime library. When RPCRT4.dll invokes an authentication routine, it delay-loads SspiCli.dll dynamically. By placing a malicious SspiCli.dll in the same directory as AppVShNotify.exe before that moment arrives, the attackers ensure their code gets loaded instead. To avoid breaking the target application, the malicious DLL forwards all expected export calls to the real SspiCli.dll. A defender watching only for DLLs landing in obvious application directories — the most common DLL hijacking detection pattern — would miss it entirely.
The mechanism is classified by MITRE ATT&CK as DLL Search Order Hijacking (sub-technique T1574.001), but NightLedger’s specific exploit path — riding RPCRT4.dll’s delay-load trigger rather than displacing a directly imported library — is a more evasive variant than the most commonly documented form. Once loaded, the backdoor creates a mutex identifier (A8215357-F99A-44FE-BC65-D8F0434B0C03) to prevent multiple instances from running, then begins periodically reaching out to its primary command-and-control server at realhealthshop[.]com via HTTPS GET requests to the path /edfcvfgbhnjmkqwasderfgg, with tjconsultingservices[.]com as a fallback, per Kaspersky’s published indicator list.
The backdoor supports 16 distinct commands spanning reconnaissance, remote execution, file management, and data exfiltration, as documented in Kaspersky’s command analysis. These include gathering user and host identity, running arbitrary processes, listing directories and logical drives, enumerating running processes, downloading and uploading files, copying or deleting files, taking screenshots, and loading additional DLLs into memory. One command stands out for its network intelligence value: NightLedger can collect C:WindowsdebugNetSetup.log — the Windows diagnostic log recording domain join and network configuration activity — together with a live process listing in a single operation, documented as command 93 in the Kaspersky technical analysis. That combination gives operators a detailed map of the victim’s network membership and active software without requiring any additional intrusion steps.
Kaspersky researchers Omar Amin and Vasily Berdnikov drew a direct lineage comparison between NightLedger and TWOSTROKE, an older Mirage Kitten backdoor previously documented by Google’s Threat Intelligence Group. Both use a similar HTTPS-based C2 communication design. NightLedger uses #%%# as a field delimiter in its command protocol; TWOSTROKE used @##@. NightLedger adds screenshot capture and NetSetup.log collection that TWOSTROKE lacked.
BridgeHead Turns Compromised Machines Into Relay Nodes — and Hides Inside Them
The second tool, BridgeHead, represents a different class of capability. Where NightLedger is a traditional backdoor — a means of remote access — BridgeHead is a full SOCKS5 tunnel proxy that converts the infected machine into a covert relay node operating over an encrypted WebSocket connection, as detailed in Kaspersky’s BridgeHead analysis.
This distinction matters operationally. A backdoor gives attackers access to the victim machine. A relay gives attackers the ability to route their own subsequent operations — lateral movement attempts, network scans, further exploitation — through the victim machine’s network connection, so that the resulting traffic appears to originate from the victim’s own IP space. Defenders tracing lateral movement within or from the compromised environment will see source addresses belonging to the victim organization, not the attacker’s infrastructure. Network-level blocking lists and outbound controls keyed to attacker-owned IP ranges become ineffective once a relay is in place.
BridgeHead deploys as unbcl.dll, placed in %LocalAppData%MicrosoftVisualStudio, a directory that blends into legitimate Visual Studio installation activity on developer machines. Before activating, it runs a deliberate anti-analysis check: it retrieves the current Windows username via the Windows API, converts it to lowercase, and searches for a specific hardcoded three-character substring. If the username does not contain that substring, the tool exits silently, per Kaspersky’s technical documentation of BridgeHead’s anti-analysis logic. This means each deployed binary is custom-compiled for a specific known target — a level of per-victim customization that also prevents the malware from running in generic sandbox analysis environments where the username does not match. Kaspersky also identified a BridgeHead variant communicating with businessmixture[.]com/blog over encrypted WebSocket on port 443 rather than the primary Azure endpoint, confirming that multiple distinct versions are in active deployment.
Once the username check passes, BridgeHead initiates an HTTPS WebSocket upgrade to its C2 server at smartconnect[.]azurewebsites[.]net, presenting a spoofed Chrome browser User-Agent string to blend with ordinary browser traffic. The server must acknowledge within 10 seconds or BridgeHead drops the connection and retries with exponential backoff capped at 60 seconds. If the corporate proxy returns an HTTP 407 authentication challenge, BridgeHead negotiates Windows-integrated authentication — preferring Negotiate protocol over NTLM — using the current user’s single sign-on credentials, as confirmed in Kaspersky’s proxy traversal analysis. This means BridgeHead can traverse corporate proxy environments without generating the authentication anomalies that less-sophisticated tunnelers produce.
From that point, all activity is server-initiated. The C2 pushes binary commands over the WebSocket channel; BridgeHead relays TCP traffic between the server’s specified targets and the channel. Kaspersky identified significant functional overlap between BridgeHead and MiniFast, a Mirage Kitten tunneling tool documented by both Check Point Research and Unit 42 in the group’s 2026 campaign during Operation Epic Fury, and internally tracked by Kaspersky as Retrograde.
ArcBridge: A Second Tunnel With a Unique Fingerprint Per Target
ArcBridge, the third tool, was first identified by Kaspersky in April 2026 in activity targeting Middle Eastern victims. It operates similarly to BridgeHead — a WebSocket-based tunnel connecting compromised machines to Mirage Kitten’s infrastructure — but with a distinct architecture. Rather than relying on runtime username checks, ArcBridge embeds its configuration directly: the C2 host (aecert[.]org), port (443), retry interval (5000 milliseconds), SSL flag, and what Kaspersky assesses is a per-implant identifier formatted as a UUID, as detailed in the ArcBridge technical section of the Kaspersky report. That per-implant UUID means each deployed binary carries a unique identifier the operators can use to distinguish compromised hosts on the C2 side, consistent with centrally managed deployment infrastructure.
Like NightLedger, ArcBridge enforces single-instance execution via a UUID-formatted mutex (F56E68DA-4A89-46B4-9AC8-7290A7651000) — a naming convention the two tools share, suggesting a common development environment. ArcBridge supports two commands: OPEN (establishing a proxy or tunnel session to an operator-selected target) and DNS (performing hostname and address resolution). Kaspersky noted infrastructure overlap between ArcBridge’s C2 domain and the group’s broader registered domain pattern.
Spear-Phishing With Fake Job Offers and Fake Video Calls
The initial access vector for most NightLedger and ArcBridge samples remained unconfirmed at the time of Kaspersky’s disclosure. BridgeHead’s deployment, however, was observed following spear-phishing activity consistent with Mirage Kitten’s established tradecraft as documented by both Unit 42 and Check Point Research.
That tradecraft centers on highly targeted social engineering. The group constructs recruitment-themed lures impersonating trusted brands and hiring platforms, directing targets to convincing fake job portals that redirect to malicious archives hosted on legitimate file-sharing services. Alongside career lures, the group deploys lookalike pages mimicking popular videoconferencing platforms — a technique that exploits the ubiquity of remote work software to deliver payloads to unsuspecting users. A May 2026 Check Point Research report documented Mirage Kitten using trojanized Zoom installers that monitored for a scheduled task Zoom normally creates during legitimate installation, then silently hijacked that task for persistence — demonstrating detailed knowledge of legitimate software behavior.
C2 Infrastructure: Azure Domains Give Way to Cloudflare Fronting
The campaign reveals a deliberate evolution in how Mirage Kitten conceals its infrastructure. The group historically relied on Microsoft Azure subdomains — a pattern visible across the current campaign’s indicators of compromise, which include multiple azurewebsites.net domains — but Kaspersky researchers observed a parallel shift toward Cloudflare-backed domains in newer malware samples, as assessed in the Kaspersky report’s conclusion. The researchers assess this transition is intended to complicate attribution and maintain resilient C2 communications, since Cloudflare’s content delivery network obscures the physical hosting origin of malicious infrastructure behind its own IP ranges.
The full published indicator list includes 22 domains and IP addresses, more than the five cited in initial third-party coverage. Key domains: realhealthshop[.]com (NightLedger primary C2), tjconsultingservices[.]com (NightLedger fallback), smartconnect[.]azurewebsites[.]net (BridgeHead primary C2), businessmixture[.]com (BridgeHead variant C2), and aecert[.]org (ArcBridge C2), alongside associated IP 172[.]86[.]98[.]113.
Iran’s State Hackers Broadened Their Toolkit as Conflict Intensified
This campaign does not exist in isolation. Operation Epic Fury — the U.S. and Israeli military strikes against Iran launched February 28, 2026 — triggered a documented surge in Iranian state cyber activity across multiple groups. Check Point Research documented three distinct Nimbus Manticore campaign waves between February and April 2026, including the introduction of the MiniFast backdoor, SEO poisoning as a new delivery vector, and AI-assisted malware development practices that accelerated the group’s tooling output under wartime conditions. A separate Cloud Security Alliance research note found coding patterns in MiniFast consistent with large language model-assisted development, including excessive defensive error handling and verbose modular naming conventions.
Separately, Group-IB disclosed on July 20, 2026, that a piece of malware named HOLLOWGRAPH — linked with high confidence to a framework called Cavern — turned compromised Microsoft 365 mailbox calendars into a covert two-way command-and-control channel, scheduling operator instructions as calendar events dated May 13, 2050 to avoid detection. Group-IB noted only low-confidence overlap with Lyceum, an Iranian-nexus actor, and declined to attribute the operator definitively to any known threat group. Kaspersky’s NightLedger disclosure and the HOLLOWGRAPH findings together suggest Iranian-linked actors are simultaneously expanding geographic targeting, diversifying malware toolchains, and investing in increasingly creative infrastructure abuse techniques.
Indicators of Compromise and Defensive Guidance
Security teams in the aof the Middle East and Africa should immediately audit for the following indicators
File system: Presence of SspiCli.dll co-located with AppVShNotify.exe in any non-standard directory (legitimate SspiCli.dll resides in C:WindowsSystem32). Presence of unbcl.dll in %LocalAppData%MicrosoftVisualStudio or libwinpthread-1.dll in unexpected locations.
- NightLedger:
A239E655709A2518DD0B7BDBED163679 - ArcBridge:
5FA15EF96808EA82F0A6176F0BB4B386,42F847597109DA2A220391BB09D00676,AFB1C1583606599C7272CFB33CC6F498 - BridgeHead:
6038D42AF0AFFD1FB263F470C0956F6B,AE628EFA305387B633DCE82F9364875B,F7D36CC5904A53252D2BB3D21615134F,C90F0EFADBF322E5EB1C4103A38C30E6,D09B14A2FE01C7363ECC56F5D046162C
Network: Block or monitor all domains and IP in the published IOC list on Kaspersky Securelist. Monitor outbound WebSocket connections (ws://, wss://) to unexpected external hosts, particularly from user-writable directories. Review HTTPS traffic to azurewebsites.net subdomains that do not correspond to known internal applications.
Behavioral: Detection for single mutex creation followed by HTTPS beaconing at regular intervals from a DLL loaded by AppVShNotify.exe. Review process trees where AppVShNotify.exe spawns children or makes outbound network connections. Extended IOCs are available to subscribers of Kaspersky’s Threat Intelligence Reporting service at intelreports@kaspersky.com.
Frequently Asked Questions
What is the NightLedger backdoor, and why does it matter?
NightLedger is a Windows backdoor discovered by Kaspersky’s GReAT team and attributed to Mirage Kitten, an Iranian IRGC-linked threat group. It disguises itself as a Windows authentication library, then exploits an obscure delay-loading sequence in Windows’ RPC runtime to load itself into memory without appearing in obvious file system locations a standard DLL hijacking scan would catch. Once active, it gives operators remote access to 16 functions — from taking screenshots to mapping the victim’s network membership — and provides persistent footholds in aviation, telecom, government, and financial-sector targets across six countries in the Middle East and Africa.
How does WebSocket-based C2 tunneling evade corporate network security?
WebSocket traffic travels over standard HTTPS port 443 and uses an HTTP upgrade mechanism that looks indistinguishable from ordinary encrypted web traffic at the network perimeter. BridgeHead goes further: it handles corporate proxy authentication challenges using Windows-integrated Negotiate and NTLM credentials, so it traverses authenticated enterprise proxies without generating the authentication failures that trigger alerts for less-sophisticated malware. Standard outbound firewall rules and IP-based blocklists are ineffective once BridgeHead establishes a relay, because subsequent attacker traffic appears to originate from the victim organization’s own network addresses.
Who are the most at-risk organizations, and what should they check right now?
Organizations in aviation, telecommunications, government, and financial services across Egypt, Jordan, Tanzania, Pakistan, Ethiopia, and Burkina Faso face the highest documented risk from this specific campaign, but the group’s prior operations have hit targets in the US, Europe, Israel, UAE, and beyond. Any organization in defense, aerospace, or critical infrastructure sectors should immediately audit for SspiCli.dll outside of C:WindowsSystem32, check for unbcl.dll or libwinpthread-1.dll in unexpected directories, and block the published C2 domains and IP. Full file hashes and an extended indicator list are published in Kaspersky’s disclosure report and available in expanded form to their Threat Intelligence Reporting subscribers.
What does this campaign reveal about Iranian state hacking after the 2026 conflict?
The NightLedger campaign is one of several documented escalations following Operation Epic Fury, the February 28, 2026 US-Israeli military strikes on Iran. Check Point Research documented Nimbus Manticore deploying three successive waves of new tooling — including the MiniFast backdoor with apparent AI-assisted development — between February and April 2026. Group-IB separately disclosed HOLLOWGRAPH, a tool hiding commands inside Microsoft 365 calendar appointments. The pattern suggests Iranian-linked threat actors used the conflict period to accelerate malware development, expand targeting geography southward into Africa, and diversify infrastructure concealment techniques simultaneously — a broader operational transformation than any single campaign discloses on its own.
ⓒ 2026 TECHTIMES.com All rights reserved. Do not reproduce without permission.
