> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Iranian cyber spies target aviation, fintech developers with new malware - URL: https://f4n6.co.uk/security-feed/iranian-cyber-spies-target-aviation-fintech-developers-with-new-malware/ - Published: 2026-09-01T14:25:04.000Z - Updated: 2026-09-01T14:25:04.000Z - Author: Jeff Davies - Tags: #security-feed, Iranian cyber spies ## 1\. Executive summary Kaspersky GReAT has documented a spear-phishing campaign by the Iran-linked actor Mirage Kitten (also tracked as UNC1549, Smoke Sandstorm, Nimbus Manticore) targeting software developers and technology specialists in the aviation, aerospace and fintech sectors across the Middle East and Africa, with victims observed in Afghanistan, Egypt and Ethiopia. The campaign uses fake recruiter outreach on LinkedIn and other job platforms to deliver trojanized coding-challenge archives that install two previously undocumented cross-platform remote access trojans, NodeRabbit (Node.js) and PollCat (obfuscated JavaScript), both capable of system reconnaissance, file creation/modification, command execution and persistent remote access on Windows, Linux and macOS. Attribution to an Iranian state-backed group is unconfirmed in our verified reference data — the actor has no MITRE ATT&CK profile — and the technical detail below is substantially single-sourced (one vendor report, corroborated only in outline by Recorded Future News). EMEA financial services clients with development teams, particularly those hiring through LinkedIn or accepting candidate-side coding exercises, should treat developer workstations as a realistic initial-access path for espionage-grade intrusion. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17: ICT-related incident management process | The campaign's delivery mechanism — a developer executing unreviewed third-party code from an external archive on a corporate endpoint — is a distinct compromise scenario that financial entities' incident processes are unlikely to cover as a class | Extend incident-management playbooks to cover "developer executes external coding-challenge code" as a reportable internal event, with defined triage steps for Node.js/JavaScript implants | | DORA Art. 24: digital operational resilience testing — general requirements | Social-engineering simulation coverage for technical hiring workflows (recruiter contact → candidate executes archive) is a specific, testable gap this campaign exposes | Include fake-recruiter lures and trojanized npm-package scenarios in social-engineering testing cycles for engineering staff, not just generic phishing simulations | | NIS2 Art. 21(2)(d): supply chain security measures | The attack chain runs through an unvetted external code artifact (bundled npm package colorized\_terminal v2.1.0, not published to the npm registry) executed on employee systems — a supply-chain intake control failure specific to this vector | Require provenance checks for any code artifact entering the environment outside normal package-registry channels; block execution of bundled, non-registry node\_modules packages pending review | No UK NIS 2018 duty is specifically triggered by the facts of this item beyond generic incident-response obligations. ## 3\. Technical analysis & attack chain ### Confirmed attack chain (as reconstructed from Kaspersky telemetry and a publicly cited victim account) 1. **Recruiter outreach.** A threat actor operating a fake account on a job-search platform — in one documented case posing as a talent acquisition specialist at a major technology company — contacts a software engineer or technology specialist and advertises a role, inviting the target to complete a technical assessment. Targets are drawn from aviation, aerospace and fintech organisations in the Middle East and Africa. 2. **Lure delivery.** The target receives a link to a coding-challenge archive hosted on Amazon S3 and is pressured to download and run the project immediately. In the PollCat variant of the lure, the target is given one hour to complete the test and must enter a six-digit access code supplied by the "recruiter" — described as single-use and short-lived — adding time pressure to open the project quickly. 3. **Trojanized project execution.** The archive contains a plausible software-engineering assessment application. In the Afghanistan case, `Front-Technical-Challenge.zip` (MD5 `1EA83E4E4592B01E4ACAB63EB867BEE5`) contained "TaskFlow", an assessment app built with Express, React and Vite. The accompanying README instructed the candidate to review the application and fix frontend defects, explicitly claimed that `server.js` was bug-free and should not be modified, imposed a three-hour time limit, and prohibited the use of AI assistants — Kaspersky assesses the AI ban was likely intended to prevent code-review assistants from flagging the malicious import (an AI auditor would likely have flagged the suspicious first-line import of an unknown npm package). 4. **Implant launch via trojanized npm package.** The first line of `server.js` imports a trojanized npm package named `colorized_terminal`, version 2.1.0\. The attackers bundled the package directly in the archive's `node_modules` directory rather than publishing it to the npm registry. On import, the package silently launches an implant from `node_modules/.cache/.320697f1/index.js` as a detached background process. 5. **Remote access established.** The implant provides the operators with remote access to the compromised machine. ### Malware capabilities and infrastructure - **NodeRabbit** is a cross-platform RAT built with Node.js, targeting Windows, Linux and macOS. Capabilities include collecting information about the victim and their computer, creating or modifying files, and executing additional commands — i.e. full interactive remote access. Kaspersky identified three NodeRabbit variants with a shared code lineage, each recovered from a system in a different country (Afghanistan, Egypt, Ethiopia), delivered through similarly themed coding challenges using two trojanized packages, `colorized_terminal` and `pretty-log`, both pinned to version 2.1.0. - **PollCat** is a second, previously undocumented cross-platform RAT written in obfuscated JavaScript, also distributed through trojanized coding-challenge archives. It is designed to provide persistent access to compromised computers and to deliver additional malicious files. Its structure is substantially different from NodeRabbit. - **Infrastructure blending.** Mirage Kitten uses legitimate Microsoft Azure and Cloudflare infrastructure for command-and-control to hinder detection and tracking. In some cases the operators included the targeted organisation's name in an Azure subdomain, making traffic between an infected device and attacker servers resemble normal corporate network traffic. This is directly relevant to egress monitoring: C2 look-alikes will resolve as legitimate cloud providers and may carry the client's own name. - **Detection naming.** Kaspersky products detect this threat as `Trojan.JS.MirageKitten.*`. - **Tradecraft shift.** Mirage Kitten has historically relied on native malware written in C, C++ and Go, often deployed through DLL search-order hijacking. NodeRabbit and PollCat are the first publicly documented use of Node.js- and JavaScript-based malware by this group. **Confidence caveats.** The technical detail above — package names, file paths, archive hash, variant lineage, infrastructure behaviour — is single-sourced from the Kaspersky GReAT report, corroborated only at headline level by Recorded Future News. Verify indicators independently before enforcement action. Attribution to an Iranian state-backed actor is unconfirmed: "Iranian cyber spies" has no MITRE ATT&CK profile in our verified reference data, and the aliases UNC1549 / Smoke Sandstorm / Nimbus Manticore are vendor tracking names reported by Kaspersky and Recorded Future, not independently confirmed here. No CISA KEV exploitation state applies — this is a malware campaign, not a CVE exploitation item. ## 4\. Mitigation & containment ### P1 — within 24 hours - Hunt for the campaign artefacts across endpoints: the archive name `Front-Technical-Challenge.zip` (MD5 `1EA83E4E4592B01E4ACAB63EB867BEE5`), the packages `colorized_terminal` and `pretty-log` at version 2.1.0 in any `node_modules` directory, and the implant path pattern `node_modules/.cache/.320697f1/index.js`. Quarantine any matches and treat the host as compromised. - Block the known delivery URL at proxy/DNS: `hxxps://oracle-challenge.s3[.]us-east-1[.]amazonaws[.]com/Front-Technical-Challenge.zip`. Note this is a single known instance; expect rotation to other S3 bucket names. - Review egress logs for `node`/`node.exe` processes making outbound connections to Azure and Cloudflare-hosted endpoints, particularly subdomains containing your own organisation's name — this is the documented C2 blending technique. ### P2 — within 72 hours - Alert engineering and recruitment teams: no employee should download or execute coding challenges, take-home assessments or code archives received via LinkedIn or any job platform on corporate systems. Route any genuine assessment through a sandboxed, isolated environment with no corporate network access. - Enforce package provenance: block or flag execution of npm packages that are bundled in `node_modules` but absent from the public npm registry. The documented technique relies entirely on side-loaded, non-registry packages. - Apply application-control/EDR policy to prevent `node` from spawning detached background processes from `.cache` paths under `node_modules`. - Brief developers that the lure explicitly bans AI assistants and imposes short deadlines — both are social-engineering pressure indicators. Any "coding challenge" with a time limit and an instruction not to modify a specific file should be treated as hostile. ### P3 — within 7 days - Update secure-development and hiring-verification procedures: candidate-side and recruiter-side code exchanges must go through a defined intake process with provenance checks (NIS2 Art. 21(2)(d) supply-chain measures). - Add the social-engineering scenario (fake recruiter → trojanized coding challenge) to resilience-testing cycles per DORA Art. 24. - Ensure the incident-management process (DORA Art. 17) explicitly covers "employee executed external code from a job platform" as an incident trigger with a defined triage path. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | -------- | --------------------------------------------------------------------------------------------- | ----------------------- | ---------------------------- | | md5 | 1EA83E4E4592B01E4ACAB63EB867BEE5 | Medium — single-sourced | Securelist (Kaspersky GReAT) | | url | hxxps://oracle-challenge.s3\[.\]us-east-1\[.\]amazonaws\[.\]com/Front-Technical-Challenge.zip | Medium — single-sourced | Securelist (Kaspersky GReAT) | | filename | Front-Technical-Challenge.zip | Medium — single-sourced | Securelist (Kaspersky GReAT) | | filepath | node\_modules/.cache/.320697f1/index.js | Medium — single-sourced | Securelist (Kaspersky GReAT) | | package | colorized\_terminal (version 2.1.0) | Medium — single-sourced | Securelist (Kaspersky GReAT) | | package | pretty-log (version 2.1.0) | Medium — single-sourced | Securelist (Kaspersky GReAT) | | filename | server.js | Medium — single-sourced | Securelist (Kaspersky GReAT) | ```iocs md5 1EA83E4E4592B01E4ACAB63EB867BEE5 url hxxps://oracle-challenge.s3[.]us-east-1[.]amazonaws[.]com/Front-Technical-Challenge.zip filename Front-Technical-Challenge.zip filepath node_modules/.cache/.320697f1/index.js package colorized_terminal package pretty-log filename server.js ``` All indicators are single-sourced from the Kaspersky GReAT report; verify before enforcement. The MD5 is labelled by length (32 hex characters) per Adverse Trace convention. **Behavioural indicators** (no further atomic IOCs — e.g. C2 domains — are published in the source material): | Behaviour | Where to observe | Confidence | | --------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------- | ----------------------- | | node process launched as detached background process from a node\_modules/.cache/ path on import of a bundled package | EDR process telemetry, endpoint execution logs | Medium — single-sourced | | Outbound connections from developer workstations to Azure/Cloudflare-hosted subdomains embedding the target organisation's own name | Proxy, DNS and NetFlow egress logs | Medium — single-sourced | | npm package present in node\_modules but absent from the public npm registry | Endpoint software inventory, package-lock audits | Medium — single-sourced | | Recruiter contact via job platform directing an employee to an external S3-hosted archive with a short deadline and an AI-assistant ban | HR/recruitment channels, employee reports, mail logs | Medium — single-sourced | ## 6\. Detection ```yara /* Adverse Trace — NodeRabbit / PollCat trojanized coding-challenge implant Detects the known implant drop path and trojanized package import chain. Reference: https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/ */ rule AT_NodeRabbit_Trojanized_NPM_Implant { meta: author = "Adverse Trace" date = "2026-09-01" reference = "https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/" description = "Detects NodeRabbit/PollCat implant artefacts: trojanized npm package import and .cache drop path from Mirage Kitten coding-challenge lures" tlp = "AMBER" strings: $pkg1 = "colorized_terminal" ascii $pkg2 = "pretty-log" ascii $path = "node_modules/.cache/.320697f1/index.js" ascii $path_bslash = "node_modules\\.cache\\.320697f1\\index.js" ascii condition: uint16(0) == 0x5A4D or filesize < 5MB and 2 of ($pkg1, $pkg2, $path, $path_bslash) } ``` ```yaml title: NodeRabbit implant launched as detached background process from node_modules .cache path id: 8e2f5a41-9c3d-4b7e-a1f2-6d8e0b3c5a79 status: experimental description: > Detects a Node.js runtime spawning a detached background process from a node_modules/.cache path, consistent with the NodeRabbit/PollCat delivery chain documented by Kaspersky GReAT (Mirage Kitten coding-challenge lures). Reference: https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/ references: - https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/ - https://therecord.media/iranian-cyber-spies-target-aviation-fintech-new-malware author: Adverse Trace date: 2026-09-01 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_node: Image|endswith: '\node.exe' selection_cache_path: CommandLine|contains: - 'node_modules\.cache\.320697f1\index.js' - 'node_modules/.cache/.320697f1/index.js' selection_pkg: CommandLine|contains: - 'colorized_terminal' - 'pretty-log' condition: selection_node and 1 of (selection_cache_path, selection_pkg) falsepositives: - Legitimate npm packages with similar names; validate against registry presence level: high ``` ## 7\. Sources - Kaspersky GReAT (Securelist) — "Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set" — https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/ — 2026-09-01 - Recorded Future News (The Record) — "Iranian cyber spies target aviation, fintech developers with new malware" — https://therecord.media/iranian-cyber-spies-target-aviation-fintech-new-malware — 2026-09-01 ## 8\. Adverse Trace position This is an espionage-grade initial-access campaign with a delivery mechanism — fake recruiter → trojanized coding challenge → side-loaded npm implant — that is purpose-built to bypass both human review and conventional perimeter controls, and it targets exactly the developer population that EMEA financial services clients employ and hire continuously. Severity is high for clients with engineering teams hiring through LinkedIn or similar platforms, particularly any with Middle East/Africa operations in aviation-adjacent or fintech supply chains; the cross-platform footprint (Windows, Linux, macOS) means macOS developer machines are not exempt. Two constraints on this assessment: attribution to an Iranian state-backed actor is unconfirmed in our verified reference data (no MITRE ATT&CK profile), and the full technical picture — package names, implant path, hash, infrastructure behaviour — is single-sourced from Kaspersky GReAT, so indicators should be verified before enforcement. We will monitor for independent corroboration of the NodeRabbit/PollCat samples, publication of C2 indicators, and any spread of the targeting beyond the currently observed geographies; clients should treat any report of an employee receiving a coding challenge via a job platform as a live incident trigger under their DORA Art. 17 process. --- [Read the original source →](https://therecord.media/iranian-cyber-spies-target-aviation-fintech-new-malware?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*