Mirage Kitten (UNC1549) fields the NightLedger backdoor and two WebSocket tunnelers, one of them built to negotiate through corporate proxies with the victim's own SSO
The load-bearing detail in Kaspersky's write-up is not the backdoor's feature list but how it gets to run and how it gets out. NightLedger ships as a file named to impersonate SspiCli.dll and is placed alongside a legitimate AppVShNotify.exe; that binary does not import SspiCli.dll directly, but it does import RPCRT4.dll, which delay-loads SspiCli.dll at the moment it invokes an RPC API requiring authentication — so the malicious module is pulled in through the normal search order, under a legitimate vendor process, and forwards the expected exports to the genuine DLL so the host keeps functioning (Kaspersky Securelist, 2026-07-28). Two properties make this awkward to catch: the load is triggered by ordinary RPC activity rather than by anything the malware does, and because exports are proxied there is no crash or functional break to notice. The backdoor beacons over HTTPS and dispatches 16 numeric commands, among them process execution, identity and host/network reconnaissance, process listing and termination, directory and drive enumeration, file copy, deletion, upload and download, screenshot capture, DLL loading, beacon-interval changes, and collection of the Windows domain-join diagnostic log, which Kaspersky describes as a diagnostic log generated during domain and workgroup join, unjoin and related network-setup operations (Kaspersky Securelist, 2026-07-28). Kaspersky attributes NightLedger to Mirage Kitten on code and behavioural similarity to the group's historical implants, and observes that its command dispatch resembles TWOSTROKE, an implant previously documented as the same actor's (Kaspersky Securelist, 2026-07-28).
The tunnelers are the part worth a hunt cycle, and the two are not equivalent. Kaspersky describes ArcBridge as the simpler tool: a WebSocket-style channel with an embedded configuration block carrying C2 host, port, a retry value, an SSL flag and a likely implant identifier, driven by two commands — one to open a tunnel session and one to resolve a hostname (Kaspersky Securelist, 2026-07-28). BridgeHead is the one built for networks that do not simply let traffic out: presented with an HTTP 407 proxy-authentication challenge it queries which schemes the proxy supports, selects Negotiate in preference to NTLM, supplies null credentials so Windows fills in the logged-in user's single-sign-on context, and retries — falling back to exponential connection retry capped at a minute when that fails (Kaspersky Securelist, 2026-07-28). The consequence for defenders is that the outbound channel authenticates as a real employee to the real proxy, so it appears in proxy logs as that user's traffic. Once established, the operator drives everything server-side and the implant only forwards, which Kaspersky describes as turning the host into a relay node so that resulting TCP traffic appears to originate inside the victim's network (Kaspersky Securelist, 2026-07-28). BridgeHead also refuses to run outside its intended target: a hardcoded 3-character value must appear as a substring of the lowercased Windows username, and the implant exits silently otherwise — behaviour Kaspersky reads as evidence of prior internal reconnaissance and per-target tailoring of each binary (Kaspersky Securelist, 2026-07-28). Victims span government and SMB environments in Jordan and Tanzania, aviation in Pakistan, telecommunications in Ethiopia, finance in Burkina Faso and organisations in Egypt (Kaspersky Securelist, 2026-07-28).
Triage: AppVShNotify.exe loading SspiCli.dll is normal and expected — the parent process, the module name and the RPC trigger are all legitimate, so none of them discriminates on its own. The signal is the loaded file's identity: SspiCli.dll resolving from the same directory as the executable rather than from the system directory, and not carrying a valid Microsoft signature. On the network side, an authenticated proxy session that upgrades to a long-lived WebSocket and then carries a sustained, bidirectional flow to a single destination is the shape to look for; ordinary user browsing through the same proxy does not hold one connection open as a steady tunnel.
The implant masquerades as SspiCli.dll and appears to be designed for DLL search-order hijacking, targeting a legitimate AppVShNotify.exe binary. While AppVShNotify.exe does not directly import SspiCli.dll, it imports RPCRT4.dll, which can delay-load SspiCli.dll when it invokes an RPC API that requires authentication.
Still, it implements the same technique of limiting execution to a specific username on the infected machine by hardcoding a 3-character control value that must appear as a substring in the lowercased Windows username retrieved via GetUserNameA. If the match fails, the implant silently exits, confirming per-target tailoring of each deployed binary.
According to our telemetry, we identified victims across Middle East and African countries including Egypt, SMB and government environments in Jordan and Tanzania, aviation organizations in Pakistan, telecommunication companies in Ethiopia and financial-sector entities in Burkina Faso.
ATT&CK mapping
8 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Execution TA0002
T1574.001Hijack Execution Flow: DLL
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.
Stealth TA0005
T1574.001Hijack Execution Flow: DLL
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.
Discovery TA0007
T1016System Network Configuration Discovery
Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp, ipconfig/ifconfig, nbtstat, and route.
T1057Process Discovery
Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
T1082System Information Discovery
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes.
Collection TA0009
T1113Screen Capture
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.
Command and Control TA0011
T1071.001Application Layer Protocol: Web Protocols
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
T1090Proxy
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
T1572Protocol Tunneling
Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.