Date: 07/30/2026
Severity: High
Summary
Researchers identified new malware used by the Iran-linked Mirage Kitten APT, including the NightLedger backdoor and ArcBridge/BridgeHead tunneling tools, to support long-term cyber-espionage operations. The malware provides remote access, command execution, file management, and covert communication to maintain persistence and evade detection. The campaign primarily targeted organizations in the Middle East and Africa across the telecommunications, aerospace, aviation, and financial sectors.
Indicators of Compromise (IOC) List
Domain/Urls | smartconnect.azurewebsites.net businessmixture.com global-reds.com maadinglobal.com Business-deegital.com business-deegital.azurewebsites.net businessdeegital.azurewebsites.net neexportfolio.azurewebsites.net neexportfolio.com neexportfolio.eastus.cloudapp.azure.com aecert.org realhealthshop.com tjconsultingservices.com thehealth-life.com buisness-centeral-transportation.com healthcarezoom-centeral.azurewebsites.net healthcarezoomcenteral.azurewebsites.net healthcarezoomcenteral.org toadreport.azurewebsites.net business-startup.azurewebsites.net businessstartup.azurewebsites.net |
IP ADdress | 172.86.98.113 |
Hash | A239E655709A2518DD0B7BDBED163679
5FA15EF96808EA82F0A6176F0BB4B386
42F847597109DA2A220391BB09D00676
AFB1C1583606599C7272CFB33CC6F498
6038D42AF0AFFD1FB263F470C0956F6B
AE628EFA305387B633DCE82F9364875B
F7D36CC5904A53252D2BB3D21615134F
C90F0EFADBF322E5EB1C4103A38C30E6
D09B14A2FE01C7363ECC56F5D046162C
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "healthcarezoom-centeral.azurewebsites.net" or url like "healthcarezoom-centeral.azurewebsites.net" or siteurl like "healthcarezoom-centeral.azurewebsites.net" or domainname like "healthcarezoomcenteral.org" or url like "healthcarezoomcenteral.org" or siteurl like "healthcarezoomcenteral.org" or domainname like "buisness-centeral-transportation.com" or url like "buisness-centeral-transportation.com" or siteurl like "buisness-centeral-transportation.com" or domainname like "healthcarezoomcenteral.azurewebsites.net" or url like "healthcarezoomcenteral.azurewebsites.net" or siteurl like "healthcarezoomcenteral.azurewebsites.net" or domainname like "aecert.org" or url like "aecert.org" or siteurl like "aecert.org" or domainname like "neexportfolio.eastus.cloudapp.azure.com" or url like "neexportfolio.eastus.cloudapp.azure.com" or siteurl like "neexportfolio.eastus.cloudapp.azure.com" or domainname like "global-reds.com" or url like "global-reds.com" or siteurl like "global-reds.com" or domainname like "neexportfolio.com" or url like "neexportfolio.com" or siteurl like "neexportfolio.com" or domainname like "businessdeegital.azurewebsites.net" or url like "businessdeegital.azurewebsites.net" or siteurl like "businessdeegital.azurewebsites.net" or domainname like "realhealthshop.com" or url like "realhealthshop.com" or siteurl like "realhealthshop.com" or domainname like "Business-deegital.com" or url like "Business-deegital.com" or siteurl like "Business-deegital.com" or domainname like "neexportfolio.azurewebsites.net" or url like "neexportfolio.azurewebsites.net" or siteurl like "neexportfolio.azurewebsites.net" or domainname like "businessstartup.azurewebsites.net" or url like "businessstartup.azurewebsites.net" or siteurl like "businessstartup.azurewebsites.net" or domainname like "smartconnect.azurewebsites.net" or url like "smartconnect.azurewebsites.net" or siteurl like "smartconnect.azurewebsites.net" or domainname like "business-deegital.azurewebsites.net" or url like "business-deegital.azurewebsites.net" or siteurl like "business-deegital.azurewebsites.net" or domainname like "businessmixture.com" or url like "businessmixture.com" or siteurl like "businessmixture.com" or domainname like "thehealth-life.com" or url like "thehealth-life.com" or siteurl like "thehealth-life.com" or domainname like "tjconsultingservices.com" or url like "tjconsultingservices.com" or siteurl like "tjconsultingservices.com" or domainname like "toadreport.azurewebsites.net" or url like "toadreport.azurewebsites.net" or siteurl like "toadreport.azurewebsites.net" or domainname like "business-startup.azurewebsites.net" or url like "business-startup.azurewebsites.net" or siteurl like "business-startup.azurewebsites.net" or domainname like "maadinglobal.com" or url like "maadinglobal.com" or siteurl like "maadinglobal.com" |
Detection Query 2 : | dstipaddress IN ("172.86.98.113") or srcipaddress IN ("172.86.98.113") |
Detection Query 3 : | md5hash IN ("42F847597109DA2A220391BB09D00676","5FA15EF96808EA82F0A6176F0BB4B386","6038D42AF0AFFD1FB263F470C0956F6B","D09B14A2FE01C7363ECC56F5D046162C","F7D36CC5904A53252D2BB3D21615134F","A239E655709A2518DD0B7BDBED163679","C90F0EFADBF322E5EB1C4103A38C30E6","AFB1C1583606599C7272CFB33CC6F498","AE628EFA305387B633DCE82F9364875B")
|
Reference:
https://securelist.com/mirage-kitten-new-tools/120811/