Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set

MITRE Techniques

• [T1566.002 ] Phishing: Spearphishing Link – Victims were contacted through job-search platforms and pushed to download a malicious coding challenge archive (‘fake recruiter accounts contacting prospective targets on a job search platform’).
• [T1189 ] Drive-by Compromise – The trojanized project archive from legitimate cloud infrastructure delivered the payload when the target downloaded and ran it (‘hosted on Amazon S3’ and ‘download and run the project immediately’).
• [T1059.007 ] Command and Scripting Interpreter: JavaScript – PollCat was written in obfuscated JavaScript and NodeRabbit used Node.js scripts for execution (‘PollCat … written in obfuscated JavaScript’ and ‘NodeRabbit … built with Node.js’).
• [T1059.003 ] Command and Scripting Interpreter: Windows Command Shell – NodeRabbit and PollCat executed shell commands through their process execution features (‘proc:start Execute an arbitrary shell command’ and ‘proc:exec Execute a process’).
• [T1105 ] Ingress Tool Transfer – PollCat could retrieve hosted files from the C2 and write them to the victim machine (‘GET /vault/ Retrieve a hosted file and write it to the victim machine’).
• [T1071.001 ] Application Layer Protocol: Web Protocols – Both families used HTTP(S) endpoints for beaconing, polling, and results submission (‘POST /api/rabbit/checkin’, ‘GET /gate/fetch?token=’).
• [T1573.001 ] Symmetric Cryptography: AES – NodeRabbit wrapped C2 request objects with AES-256-GCM (‘wraps it with AES-256-GCM’).
• [T1041 ] Exfiltration Over C2 Channel – PollCat uploaded command results and local file chunks through C2 endpoints (‘Submit a Base64-encoded command-result structure’ and ‘Upload a local file or file chunk to the C2’).
• [T1027 ] Obfuscated Files or Information – PollCat was delivered in obfuscated JavaScript and used hidden/misleading packaging to evade detection (‘written in obfuscated JavaScript’ and ‘fake extension displayed as GitHub Copilot Helper’).
• [T1547.001 ] Registry Run Keys / Startup Folder – NodeRabbit persisted via HKCU Run registry keys on Windows (‘creates HKCUSoftwareMicrosoftWindowsCurrentVersionRun’).
• [T1053.005 ] Scheduled Task/Job: Scheduled Task – Multiple variants created scheduled tasks for persistence (‘creates a scheduled task named IntelDriverSupportUpdate’ and ‘daily 10AM task’).
• [T1053.003 ] Scheduled Task/Job: Cron – Linux and macOS variants established persistence with cron ‘@reboot cron entry’ and ‘daily 09AM cron line’.
• [T1543.001 ] Create or Modify System Process: Launch Agent – macOS variants used LaunchAgents for startup persistence (‘creates … LaunchAgents/com.microsoft.edgeupdate.plist’ and ‘com.intel.dsa.helper’).
• [T1204.002 ] User Execution: Malicious File – Execution depended on the victim running the downloaded assessment project (‘download and run the project immediately’).
• [T1518.001 ] Software Discovery – PollCat’s SYSTEM_CHECK enumerated installed software directories and vendor-named folders (‘searches for folders matching … security software vendor names’).
• [T1082 ] System Information Discovery – NodeRabbit and PollCat gathered host, OS, username, domain, MAC, and process information (‘Return hostname, domain user information’ and ‘Submit host, user, domain, OS information’).