> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set - URL: https://f4n6.co.uk/security-feed/mirage-kitten-targeting-aviation-and-fintech-sectors-across-the-middle-east-and-africa-with-a-new-malware-set/ - Published: 2026-09-01T14:24:32.000Z - Updated: 2026-09-01T14:24:32.000Z - Author: Jeff Davies - Tags: #security-feed, Mirage Kitten ## 1\. Executive summary Kaspersky GReAT has documented a campaign of targeted cyber-espionage activity against the aviation, aerospace and FinTech sectors across the Middle East and Africa (confirmed victims in Egypt, Ethiopia and Afghanistan), delivered via fake recruiter personas on LinkedIn and other job platforms that pressure software engineers into downloading and running trojanized coding-challenge archives hosted on Amazon S3\. The campaign introduces two previously undocumented cross-platform RAT families — NodeRabbit (Node.js) and PollCat (obfuscated JavaScript) — both targeting Windows, Linux and macOS, with full file, process and shell command capability, developer-workflow persistence (fake VS Code extension, Git hooks, scheduled tasks, cron, LaunchAgents), and C2 hosted on Azure Websites and Cloudflare-fronted domains that blend into legitimate corporate traffic. Kaspersky attributes the activity to Mirage Kitten with high confidence; however, Mirage Kitten has no MITRE ATT&CK profile in our verified reference data, so the attribution must be treated as unconfirmed for the purposes of this advisory. No CVE is involved — this is a social-engineering and malicious-code-delivery campaign, not a patchable vulnerability — so the primary exposure for EMEA financial services clients is developer and engineering staff being recruited or job-hunting on LinkedIn, and the risk of espionage-grade RATs establishing long-lived persistence on developer endpoints, including in WSL environments. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ----------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17: ICT-related incident management process | The campaign delivers developer-workstation RATs with multi-OS persistence (scheduled tasks, cron, LaunchAgents, Git hooks, fake VS Code extensions) that are designed to survive reboots and evade casual review; victims include a FinTech organisation in scope of the campaign's targeting. | Clients whose incident management process does not cover developer endpoints (including WSL and personal-device job-application workflows) should extend detection and containment playbooks to these platforms before an incident forces it. | | DORA Art. 18: classification of ICT-related incidents and cyber threats | A confirmed espionage-motivated intrusion into a FinTech-sector victim constitutes a cyber threat that must be classified under the entity's classification criteria to determine whether it is major. | Ensure the classification process can distinguish espionage-motivated compromise (no ransomware, no extortion, no data-destruction observed) from disruptive incidents, and that classification drives the correct reporting decision. | | NIS2 Art. 21(2)(d): supply chain security measures | The initial-access vector is a trojanized third-party code artefact (unpublished npm packages colorized\_terminal and pretty-log bundled into node\_modules) that staff execute outside the organisation's software supply chain controls. | Review whether developer security measures cover code executed during recruitment exercises and from untrusted archives, not just production dependency management. | No other article in the regulatory reference is specifically engaged. We note that DORA Art. 19 (reporting of major incidents) would only be triggered by an actual confirmed incident at the client, which this advisory does not assert. ## 3\. Technical analysis & attack chain ### Confirmed attack chain (reconstructed from Kaspersky telemetry and a corroborating public account of the delivery chain) 1. A threat actor operating a fake recruiter persona (posing as a talent acquisition specialist at a major technology company) contacts a software engineer on LinkedIn or another job search platform and advertises a role requiring a technical assessment. 2. The target receives a link to a coding-challenge ZIP archive hosted on legitimate cloud infrastructure — Amazon S3 (observed bucket: `oracle-challenge.s3[.]us-east-1.amazonaws[.]com`) — and is pressured to download and run the project immediately. The lure README imposes a three-hour time limit and prohibits AI assistants, both of which suppress review of the malicious code. 3. The archive contains a plausible full-stack application (e.g. TaskFlow, built with Express, React and Vite). The README directs the candidate to fix frontend defects and asserts that `server.js` is bug-free and must not be modified — steering attention away from the only altered file. 4. The first line of `server.js` imports a trojanized npm package — `colorized_terminal` or `pretty-log`, both pinned to version 2.1.0 — bundled directly in the archive's `node_modules` directory rather than published to the npm registry. On import, the package launches the implant from `node_modules/.cache/.320697f1/index.js` as a detached background process. 5. The implant (NodeRabbit or PollCat) establishes per-OS persistence and begins encrypted C2 communication with Azure-hosted and Cloudflare-fronted infrastructure. **NodeRabbit — technical detail.** Cross-platform Node.js RAT, three variants with shared code lineage, each recovered from a system in a different country (Afghanistan, Egypt, Ethiopia). - **Agent ID:** SHA-256 hash of hostname, username, OS version, architecture and MAC address, truncated to the first 32 hex characters. - **Single-instance:** Variant 1 binds a TCP listener to `127.0.0.1:48739`; if the bind fails it exits silently. Variant 2 derives a host-specific port from the agent ID: `41984 + (value mod 5000)` where value is the first four hex characters of the identifier interpreted as an integer (port range 41984–46983). - **Variant 1 persistence:** Windows — copies itself to `%APPDATA%\Microsoft\EdgeUpdate\msedge_update.js`, clones local `node.exe` to `nodew.exe` in the same folder and patches its PE subsystem from Console to Windows GUI to suppress the console window, then creates `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdate` executing `nodew.exe msedge_update.js`. Linux — copies to `~/.config/microsoft-edge-update/msedge_update.js` with an `@reboot` cron entry. macOS — copies to `~/.config/microsoft-edge-update`, creates `~/Library/LaunchAgents/com.microsoft.edgeupdate.plist` with RunAtLoad and KeepAlive, and attempts to load it. - **Variant 2 persistence:** masquerades as Intel Driver & Support Assistant. Windows — copies to `%LOCALAPPDATA%\Intel\DSA\idriver_support.js`, copies `node.exe` to `IntelDSA.exe` with the same PE Console→GUI subsystem patch, and creates a scheduled task named `IntelDriverSupportUpdate` running daily at 10:00\. Linux — `~/.config/intel-dsa/idriver_support.js` plus `@reboot` cron. macOS — `~/Library/Application Support/Intel DSA/idriver_support.js` with LaunchAgent `com.intel.dsa.helper` (RunAtLoad, KeepAlive). - **Variant 2 anti-analysis:** terminates if it detects limited system memory, low CPU count, short uptime, analyst-associated usernames/hostnames, or common analysis tools; before exiting it emits benign HEAD requests to `www.google.com`, `www.microsoft.com` and `www.cloudflare.com` and never contacts C2. - **Variant 2 proxy awareness:** checks HTTP(S) proxy environment variables, Windows Internet Settings including explicit PAC URL, and WinHTTP configuration; tunnels HTTPS C2 through HTTP CONNECT; retries with URL-embedded basic credentials; finally delegates NTLM/Negotiate challenges to `curl.exe --proxy-anyauth --proxy-user` using the victim's logon session. Proxy-discovery results are cached for five minutes and invalidated on network-interface or IP change. - **Variant 1 C2:** three Azure-hosted addresses with failover — `plugplay.azurewebsites[.]net`, `Rgbteller.azurewebsites[.]net`, `Wslwebui.azurewebsites[.]net` — using `POST /api/rabbit/checkin` (register), `POST /api/rabbit/task` (poll), `POST /api/rabbit/result` (submit). - **C2 cryptography:** request objects serialised as JSON, wrapped with AES-256-GCM; the AES key is the SHA-256 digest of an ASCII seed embedded in the agent; fresh 12-byte IV and 16-byte authentication tag per request. Wire format: `{ "d": "base64(IV || ciphertext || authentication_tag)", "_r": "8 hexadecimal characters", "_t": "epoch timestamp" }`. C2 responses use the same structure and may carry a command. - **Variant 1 commands (11):** `sys:info`, `proc:list`, `proc:start` (arbitrary shell command), `fs:list`, `fs:read` (chunked, Base64), `fs:write` (Base64, chosen file offset), `fs:delete`, `fs:mkdir`, `net:config`, `agent:sleep`, `script:exec` (writes a Base64 Node.js script to a randomly named `.tmp` file, executes, deletes). - **Variant 3 (Ethiopia):** launched via `pretty-log`; C2 chain of Azure- and Cloudflare-hosted domains — `visitfinancedentists[.]com`, `kyrasey-f8hfexa5cqamh7fk.westeurope-01.azurewebsites[.]net`, `healthcomfsdpower[.]com` — with new endpoints `POST /sdk/v2/ready`, `POST /sdk/v2/config`, `POST /sdk/v2/events`. Persistence: Windows — attempts ProgramData (with `/ru SYSTEM /rl highest` if it can list `C:\Windows\System32\config`) or LocalAppData fallback, build-specific daily 10:00 task; macOS — `~/Library/Application Support` with RunAtLoad/KeepAlive LaunchAgent; Linux — `~/.local/share` with `@reboot` cron (skipped if `crontab -l` fails); **WSL** — reuses the Linux copy, writes `launcher.vbs` under the Windows user profile and creates a daily 10:00 Windows task relaunching via `wscript.exe` and `wsl.exe`. Retains the original 11 commands and adds 12, including `outlook:emails` (harvest account addresses from Outlook OST/PST artifacts), `agent:servers` (replace in-memory C2 list, optionally persisted to `.sv.json`), `agent:getchain`, `proc:exec`, `proc:kill`, `fs:drives`, and the developer-workflow persistence set below. - **Variant 3 developer-workflow persistence:** `persist:vscode` creates a fake VS Code extension displayed as "GitHub Copilot Helper" with description "AI coding assistant helper service" and activation event `onStartupFinished`; its `extension.js` starts the installed payload as a detached Node.js process, borrowing a trusted publisher name from local extension metadata or a `trustedPublishers` value in `state.vscdb` (no signature or trusted status actually copied); it also attempts to disable VS Code Workspace Trust and, on Windows, falls back to a current-user Run registry key if the extension directory is missing. `persist:projects:scan` checks recent VS Code workspace paths and the first 60 immediate children of common locations such as `~/projects` and `~/source` (max 20 repositories returned); `persist:project:inject` appends a marked launcher to `.git/hooks/post-merge` and `.git/hooks/post-checkout`, with marker `# shepherd-persist;` followed by a line that starts the installed payload with Node in the background. `persist:check` audits selected VS Code, scheduled-task and Run-key persistence indicators; `persist:vscode:remove` and `persist:project:remove` clean up. **PollCat — technical detail.** Cross-platform RAT in obfuscated JavaScript, delivered via a separate lure: `RankChallenge-react`, a React code-fixing challenge presented as a time-limited assessment. Running the project invokes `npm i && node index.js`. - **Lure mechanics:** the project uses CTF terminology throughout (root package named `ctf-server`, backend prints "CTF server running", `ctf-*` storage keys, tutorial references `path/to/ctf`) — Kaspersky assesses this as consistent with an AI-assisted or template-generated project into which the attacker later inserted malicious components. The bundled PDF tutorial instructs the target to click Continue, enter a six-digit OTP supplied by the "recruiter" (single-use, expiring, claimed to rotate every 30 seconds) and complete the challenge within a one-hour session. The bundled `.env` contains the JWT signing secret, OTP service URL and OTP client ID. Submitted codes are forwarded to an attacker-managed domain registered in late June 2026: `https://lifespotify[.]com/api/users/b879746e-fed9-4211-a6da-4d8223681267/otp/validate`. - **Execution independent of OTP:** at application startup, `app.js` loads `requireAuth.js`, which imports and immediately starts the malicious `requireObjects.js`. PollCat begins C2 registration and command polling before the user enters any access code; a failed OTP leaves PollCat running in the background. A successful OTP validation issues a JWT, spawns an additional PollCat worker, and triggers persistence on the first authenticated request to the protected middleware. - **Persistence:** Windows — writes `package.json` and `requireObject.js` to `%APPDATA%\Microsoft\Network`, runs `npm install`, creates a daily 09:00 task named `NetSync_` running the worker with Node.js. Linux — writes the worker to `~/.node_packages`, runs `npm i`, appends a daily 09:00 cron line and an `@reboot` line. macOS — same `~/.node_packages` copy and cron path, plus `~/Library/LaunchAgents/com.harsh.requireobject.plist` with RunAtLoad and a daily 09:00 trigger. - **C2:** host identified as `129--`; iterates `sahi-finance[.]com`, `GamebarAppinformation[.]azurewebsites[.]net`, `GamebarApp[.]azurewebsites[.]net` until registration succeeds. Registration: `POST /beacon` with JSON body `{"clientId":"","type":"poll","pcName":"","userName":""}`. Unusually, a successful registration is signalled by an **HTTP 400** response containing `{"socketId":"","pollInterval":,"jitterTime":}`; the socketId is stored and used as the session token. Subsequent traffic: `POST /gate/hello` (host, user, domain, OS, privilege level), `GET /gate/fetch?token=` (poll), `POST /gate/submit` (Base64-encoded results), `GET /vault/` (retrieve hosted file to victim), `PUT /vault/push/` (upload local file or chunk to C2), `POST /gate/track` (report chunk-upload progress). Default poll interval two minutes with up to five seconds jitter. Commands and results are stored as little-endian binary records carried as Base64 text. - **Commands (22 declared, three unimplemented):** directory listing, move, shell execution, process listing, delete, C2-to-victim file download, victim-to-C2 upload, drive enumeration, process termination by PID, DLL load and exported-function call on Windows (RUNDLL), mkdir, ZIP create/extract, chunked upload, hidden background process, `EVAL_JS` (executes C2-supplied JavaScript with access to Node.js modules, files, processes, networking and child-process functions), `SYSTEM_CHECK`, `SET_SLEEP_TIME`, `SET_IDLE_TIME`, `SET_JITTER_TIME`; `WS_DOWNLOAD`, `REQUEST_ELEVATION` and `PERSIST` are defined but not implemented. - **Security-software inventory:** `SYSTEM_CHECK` collects running process names and lists files/folders, and searches for folders matching 24 hardcoded security-vendor strings: 'Google', 'Microsoft', 'Palo Alto Networks', 'Cisco', 'VMware', 'Fortinet', 'Citrix', 'CheckPoint', 'Juniper Networks', 'LogMeIn', 'Sophos', 'Symantec', 'Trend Micro', 'McAfee', 'Kaspersky Lab', 'ESET', 'Bitdefender', 'Avast Software', 'CrowdStrike', 'SentinelOne', 'Malwarebytes', 'BraveSoftware', 'Tencent', 'Naver'. On a match it lists that folder's root contents (non-recursive) and sends the inventory as JSON to `POST /api/system-details/result`. **Infrastructure.** Mirage Kitten continues to use Azure Websites (AS8075, registrar MarkMonitor Inc.) and Cloudflare-backed domains (AS13335, NameCheap/Dynadot) for C2\. In some cases the actors incorporated the targeted organisation's name into the Azure subdomain, making C2 traffic resemble normal business traffic from an employee machine. Pattern analysis across C2 channels including `msmanagementgrp[.]com` and `visitfinancedentists[.]com` led Kaspersky to approximately 11 additional infrastructure assets (see §5). **Attribution and confidence caveats.** Kaspersky attributes this activity to Mirage Kitten with high confidence, citing (per the related corpus-1 reporting on the group's broader toolset) code and behavioural overlap with the MiniFast/Retrograde toolset: both treat HTTP 400 as a successful handshake and parse a socketId from the body; near-identical host-registration request bodies (`/gate/hello` vs `/agent/init`); the same `GET ...?token=` polling pattern; identical default poll interval 120,000 ms (0x1D4C0), jitter 5,000 ms (0x1388) and retry timeout 60,000 ms (0xEA60); the same unimplemented REQUEST\_ELEVATION (0xB0) / PERSIST (0xB1) command slots; and the same proxy-aware C2 design delegating NTLM/Negotiate to `curl.exe --proxy-anyauth --proxy-user` versus a native WinHttp equivalent. **However, Mirage Kitten has no MITRE ATT&CK profile in Adverse Trace's verified reference data, so we treat the attribution as unconfirmed.** The entire technical dataset in this advisory is single-sourced (one vendor report, Kaspersky GReAT); The Record's coverage corroborates only the discovery geography (Afghanistan, then Egypt and Ethiopia), not the malware internals. Single-sourced; verify before enforcement. ## 4\. Mitigation & containment ### P1 — within 24 hours 1. **Hunt for the lure archives.** Search web/mail proxy logs, EDR download events and endpoint filesystems for the observed archive filenames: `Front-Technical-Challenge.zip`, `FrontEnd-Task.zip`, `Task-FullStack.zip`, `fullstack-1536.zip`, `webapp76592.zip`, `webapp76531.zip`, `challenges-17831.zip`, `challenges-17832.zip`, `Project-1802.zip`, `Case-34234.zip`, `RankChallenge-react-6uJSX3-main.zip`. Block and quarantine any hits; interview the recipient. 2. **Block C2 infrastructure at the egress proxy and DNS resolver.** All domains in §5 are candidate blocks; at minimum block the active C2 sets: `plugplay.azurewebsites[.]net`, `rgbteller.azurewebsites[.]net`, `wslwebui.azurewebsites[.]net`, `visitfinancedentists[.]com`, `healthcomfsdpower[.]com`, `kyrasey-f8hfexa5cqamh7fk.westeurope-01.azurewebsites[.]net`, `sahi-finance[.]com`, `gamebarapp.azurewebsites[.]net`, `gamebarappinformation.azurewebsites[.]net`, `lifespotify[.]com`, `msmanagementgrp[.]com`, `msmanagementgrpmedia[.]com`. Note: blocking `*.azurewebsites.net` wholesale will break legitimate Azure App Service traffic — block per-host and alert on any other `*.azurewebsites.net` host receiving POST-heavy beaconing patterns. 3. **Sweep developer endpoints for the persistence artefacts.** Windows: scheduled tasks named `IntelDriverSupportUpdate`, `NetSync_`, and any build-specific daily 10:00 task; Run key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdate`; files `%APPDATA%\Microsoft\EdgeUpdate\msedge_update.js` and `nodew.exe`, `%LOCALAPPDATA%\Intel\DSA\idriver_support.js` and `IntelDSA.exe`, `%APPDATA%\Microsoft\Network\requireObject.js` and `package.json`. Linux/macOS: `~/.config/microsoft-edge-update/`, `~/.config/intel-dsa/`, `~/.local/share` payload copies, `~/.node_packages`, `@reboot` and daily 09:00/10:00 cron entries, LaunchAgents `com.microsoft.edgeupdate.plist`, `com.intel.dsa.helper`, `com.harsh.requireobject.plist`. WSL: `launcher.vbs` under the Windows user profile and any daily 10:00 task invoking `wscript.exe` with `wsl.exe`. 4. **Sweep developer workflow persistence.** VS Code extensions named "GitHub Copilot Helper" (description "AI coding assistant helper service", activation `onStartupFinished`); Git repositories for the marker `# shepherd-persist;` in `.git/hooks/post-merge` and `.git/hooks/post-checkout`; `.sv.json` files written by `agent:servers`. 5. **Isolate any confirmed-infected host.** Full reimage is recommended given `script:exec`/`EVAL_JS` arbitrary-code capability; at minimum remove all persistence entries above and rotate any credentials, tokens and SSH keys present on the host. `outlook:emails` harvesting means OST/PST-exposed mailbox addresses should be treated as enumerated. ### P2 — within 72 hours 1. **Alert on the single-instance listener behaviour.** Variant 1 binds `127.0.0.1:48739`; Variant 2 binds a host-specific port in 41984–46983\. EDR/NetFlow rules for loopback listeners in these ranges on developer endpoints are cheap and high-signal. 2. **Detect the C2 protocol shapes.** PollCat: outbound POST to `/beacon` followed by an HTTP 400 response treated as success, then GET `/gate/fetch?token=`; NodeRabbit Variant 3: POST `/sdk/v2/ready`, `/sdk/v2/config`, `/sdk/v2/events`. NodeRabbit Variant 1/2: POST `/api/rabbit/checkin`, `/api/rabbit/task`, `/api/rabbit/result`. These URI paths on non-business hosts warrant alerting. 3. **Brief engineering and recruitment-facing staff.** The delivery vector is recruiter contact on LinkedIn/job platforms pressuring immediate download and execution of a coding challenge, with artificial time limits and prohibitions on AI assistants. Instruct developers never to run third-party coding-challenge projects on corporate endpoints; route any such request through security. Advise that AI code-review tooling would likely have flagged the malicious first-line import — the lure's explicit prohibition of AI assistants is itself an indicator. 4. **Review npm supply-chain controls.** The trojanized packages (`colorized_terminal`, `pretty-log`, both "2.1.0") were bundled in `node_modules` and never published to the npm registry — registry allow/deny lists alone will not catch this. Controls must cover execution of bundled, unpublished packages from untrusted archives. ### P3 — within 7 days 1. **Extend monitoring to Linux, macOS and WSL developer fleets.** All three NodeRabbit variants and PollCat are cross-platform; Windows-only EDR coverage leaves the Linux/macOS persistence paths (`cron`, LaunchAgents, `~/.node_packages`) invisible. 2. **Audit scheduled tasks and cron for masquerading names.** The group favours plausible update-themed names (`IntelDriverSupportUpdate`, `NetSync_`, `MicrosoftEdgeUpdate` Run key, `WindowsSecurityUpdate` in the related MiniFast toolset). Baseline legitimate update tasks and alert on new ones with Node.js/wscript command lines. 3. **Check proxy egress for `curl.exe --proxy-anyauth --proxy-user` invocations** initiated by Node.js processes — the malware delegates NTLM/Negotiate proxy auth to curl using the victim's logon session, which is an anomalous parent-child pattern. 4. **Review historical DNS/HTTP logs (from May 2026) against the full §5 domain list**, including the 11 additional infrastructure assets registered May–July 2026, to establish whether any pre-existing exposure predates this reporting. ## 5\. Indicators of compromise All indicators are drawn from the Kaspersky GReAT report (single source). Confidence reflects corroboration only within that source. | type | value | confidence | source | | ------ | ------------------------------------------------------------------------------------------------- | ---------- | ------------------------------------------------- | | md5 | 1EA83E4E4592B01E4ACAB63EB867BEE5 | High | Kaspersky (Front-Technical-Challenge.zip) | | md5 | CBAAF0900A13F28E380F49ADECEC932C | High | Kaspersky (FrontEnd-Task.zip) | | md5 | 366515822D5AC1CC500711EF57A2E32E | High | Kaspersky (Task-FullStack.zip) | | md5 | CF449F1992C2819E62AC44A0B06AC2E7 | High | Kaspersky (fullstack-1536.zip) | | md5 | E95A4366686E3F786EA3C056FAB5B0DA | High | Kaspersky (webapp76592.zip) | | md5 | DE5AF16A3757EF700B01DC34D67079AE | High | Kaspersky (webapp76531.zip) | | md5 | BE086789568441D0D7E4679AEE51F566 | High | Kaspersky (challenges-17831.zip) | | md5 | E259C5EDF158AAC4CFE14F77DDD0B196 | High | Kaspersky (challenges-17832.zip) | | md5 | 291AC3ABE73C5158E59A437B75D5F0AA | High | Kaspersky (Project-1802.zip) | | md5 | 0962F56D7EC69F4F2A0162DCBE22116B | High | Kaspersky (Case-34234.zip) | | md5 | 795E053A990A1569FFDCB57F48F6D085 | High | Kaspersky (RankChallenge-react-6uJSX3-main.zip) | | domain | oracle-challenge.s3\[.\]us-east-1.amazonaws\[.\]com | High | Kaspersky (S3 lure hosting) | | domain | naturalapplication.azurewebsites\[.\]net | High | Kaspersky (NodeRabbit sample 1 C2) | | domain | retaildemo.azurewebsites\[.\]net | High | Kaspersky (NodeRabbit sample 1 C2) | | domain | tubitak.azurewebsites\[.\]net | High | Kaspersky (NodeRabbit sample 1 C2) | | domain | rgbteller.azurewebsites\[.\]net | High | Kaspersky (NodeRabbit sample 2 C2) | | domain | wslwebui.azurewebsites\[.\]net | High | Kaspersky (NodeRabbit sample 2 C2) | | domain | plugplay.azurewebsites\[.\]net | High | Kaspersky (NodeRabbit sample 2 C2) | | domain | crossdwm.azurewebsites\[.\]net | High | Kaspersky (NodeRabbit sample 3 C2) | | domain | wdisystem.azurewebsites\[.\]net | High | Kaspersky (NodeRabbit sample 3 C2) | | domain | wslmenus.azurewebsites\[.\]net | High | Kaspersky (NodeRabbit sample 3 C2) | | domain | dnshnsdev.azurewebsites\[.\]net | High | Kaspersky (NodeRabbit sample 4 C2) | | domain | hpjumpsrv.azurewebsites\[.\]net | High | Kaspersky (NodeRabbit sample 4 C2) | | domain | storview.azurewebsites\[.\]net | High | Kaspersky (NodeRabbit sample 4 C2) | | domain | healthcomfsdpower\[.\]com | High | Kaspersky (NodeRabbit sample 5 C2) | | domain | visitfinancedentists\[.\]com | High | Kaspersky (NodeRabbit sample 5 C2) | | domain | kyrasey-f8hfexa5cqamh7fk.westeurope-01.azurewebsites\[.\]net | High | Kaspersky (NodeRabbit sample 5 C2) | | domain | greenyjsgfd.azurewebsites\[.\]net | High | Kaspersky (NodeRabbit sample 6 C2) | | domain | helptellerbls.azurewebsites\[.\]net | High | Kaspersky (NodeRabbit sample 6 C2) | | domain | timedrv.azurewebsites\[.\]net | High | Kaspersky (NodeRabbit sample 6 C2) | | domain | userwellgtfs.azurewebsites\[.\]net | High | Kaspersky (NodeRabbit sample 6 C2) | | domain | hecowime-aqdphyd4bbdef6es.westeurope-01.azurewebsites\[.\]net | High | Kaspersky (NodeRabbit sample 7 C2) | | domain | msmanagementgrp\[.\]com | High | Kaspersky (NodeRabbit sample 7 C2) | | domain | msmanagementgrpmedia\[.\]com | High | Kaspersky (NodeRabbit sample 7 C2) | | domain | lifespotify\[.\]com | High | Kaspersky (PollCat OTP validation / C2) | | domain | gamebarapp.azurewebsites\[.\]net | High | Kaspersky (PollCat C2) | | domain | gamebarappinformation.azurewebsites\[.\]net | High | Kaspersky (PollCat C2) | | domain | sahi-finance\[.\]com | High | Kaspersky (PollCat C2) | | domain | healthful-hub\[.\]com | Medium | Kaspersky (attributed infrastructure, 2026-07-03) | | domain | neumedicahealthcare\[.\]com | Medium | Kaspersky (attributed infrastructure, 2026-07-03) | | domain | optimumhealthcredit\[.\]com | Medium | Kaspersky (attributed infrastructure, 2026-07-03) | | domain | healthfullyrecipes\[.\]com | Medium | Kaspersky (attributed infrastructure, 2026-06-30) | | domain | refreshhealthandwellness\[.\]com | Medium | Kaspersky (attributed infrastructure, 2026-06-09) | | domain | healthvitalitycare\[.\]com | Medium | Kaspersky (attributed infrastructure, 2026-05-18) | | domain | aceofspadesmanagement\[.\]com | Medium | Kaspersky (attributed infrastructure, 2026-05-18) | | domain | glmediaagency\[.\]com | Medium | Kaspersky (attributed infrastructure, 2026-05-18) | | domain | digimediaskill\[.\]com | Medium | Kaspersky (attributed infrastructure, 2026-05-18) | | domain | healthyweightplan\[.\]com | Medium | Kaspersky (attributed infrastructure, 2026-05-18) | | domain | mens-health-online\[.\]com | Medium | Kaspersky (attributed infrastructure, 2026-05-15) | | url | hxxps://oracle-challenge\[.\]s3\[.\]us-east-1\[.\]amazonaws\[.\]com/Front-Technical-Challenge.zip | High | Kaspersky (lure download) | | url | hxxps://lifespotify\[.\]com/api/users/b879746e-fed9-4211-a6da-4d8223681267/otp/validate | High | Kaspersky (PollCat OTP forwarding) | Note on the S3 lure URL: the source presents the bucket hostname already defanged (`oracle-challenge.s3[.]us-east-1.amazonaws[.]com`); we reproduce it as given. ```iocs md5 1EA83E4E4592B01E4ACAB63EB867BEE5 md5 CBAAF0900A13F28E380F49ADECEC932C md5 366515822D5AC1CC500711EF57A2E32E md5 CF449F1992C2819E62AC44A0B06AC2E7 md5 E95A4366686E3F786EA3C056FAB5B0DA md5 DE5AF16A3757EF700B01DC34D67079AE md5 BE086789568441D0D7E4679AEE51F566 md5 E259C5EDF158AAC4CFE14F77DDD0B196 md5 291AC3ABE73C5158E59A437B75D5F0AA md5 0962F56D7EC69F4F2A0162DCBE22116B md5 795E053A990A1569FFDCB57F48F6D085 domain oracle-challenge[.]s3[.]us-east-1[.]amazonaws[.]com domain naturalapplication[.]azurewebsites[.]net domain retaildemo[.]azurewebsites[.]net domain tubitak[.]azurewebsites[.]net domain rgbteller[.]azurewebsites[.]net domain wslwebui[.]azurewebsites[.]net domain plugplay[.]azurewebsites[.]net domain crossdwm[.]azurewebsites[.]net domain wdisystem[.]azurewebsites[.]net domain wslmenus[.]azurewebsites[.]net domain dnshnsdev[.]azurewebsites[.]net domain hpjumpsrv[.]azurewebsites[.]net domain storview[.]azurewebsites[.]net domain healthcomfsdpower[.]com domain visitfinancedentists[.]com domain kyrasey-f8hfexa5cqamh7fk[.]westeurope-01[.]azurewebsites[.]net domain greenyjsgfd[.]azurewebsites[.]net domain helptellerbls[.]azurewebsites[.]net domain timedrv[.]azurewebsites[.]net domain userwellgtfs[.]azurewebsites[.]net domain hecowime-aqdphyd4bbdef6es[.]westeurope-01[.]azurewebsites[.]net domain msmanagementgrp[.]com domain msmanagementgrpmedia[.]com domain lifespotify[.]com domain gamebarapp[.]azurewebsites[.]net domain gamebarappinformation[.]azurewebsites[.]net domain sahi-finance[.]com domain healthful-hub[.]com domain neumedicahealthcare[.]com domain optimumhealthcredit[.]com domain healthfullyrecipes[.]com domain refreshhealthandwellness[.]com domain healthvitalitycare[.]com domain aceofspadesmanagement[.]com domain glmediaagency[.]com domain digimediaskill[.]com domain healthyweightplan[.]com domain mens-health-online[.]com url hxxps://oracle-challenge[.]s3[.]us-east-1[.]amazonaws[.]com/Front-Technical-Challenge.zip url hxxps://lifespotify[.]com/api/users/b879746e-fed9-4211-a6da-4d8223681267/otp/validate ``` **Behavioural indicators** (not machine-pivotable atomics; excluded from the block above): | behaviour | where to observe | confidence | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------- | -------------------- | | Loopback TCP listener on 127.0.0.1:48739 (NodeRabbit V1) or host-derived port 41984–46983 (V2) | EDR process/network telemetry on developer endpoints | High (single source) | | Node.js process making POST requests to /api/rabbit/checkin, /api/rabbit/task, /api/rabbit/result, or /sdk/v2/ready, /sdk/v2/config, /sdk/v2/events | Egress proxy / HTTP inspection logs | High (single source) | | POST to /beacon followed by HTTP 400 treated as success, then GET /gate/fetch?token= | Egress proxy / HTTP inspection logs | High (single source) | | node.exe/Node child process invoking curl.exe --proxy-anyauth --proxy-user | EDR process-tree telemetry | High (single source) | | Creation of scheduled task IntelDriverSupportUpdate (daily 10:00) or NetSync\_ (daily 09:00) | Windows event logs / EDR | High (single source) | | @reboot and daily 09:00/10:00 cron entries invoking .js files under \~/.config, \~/.local/share or \~/.node\_packages | Linux/macOS endpoint auditing | High (single source) | | Git hook files .git/hooks/post-merge / .git/hooks/post-checkout containing marker \# shepherd-persist; | Developer workstations, CI runners | High (single source) | | VS Code extension "GitHub Copilot Helper" with activation event onStartupFinished | VS Code extension directories, state.vscdb | High (single source) | | wscript.exe launching launcher.vbs which invokes wsl.exe via a daily 10:00 scheduled task | Windows telemetry on WSL-enabled hosts | High (single source) | ## 6\. Detection The sources provide distinctive strings, file paths, registry keys, scheduled-task names and C2 URI paths that are artefacts of the threat itself, enabling the rules below. ```yara rule NodeRabbit_PollCat_MirageKitten_Implant_Strings { meta: author = "Adverse Trace" date = "2026-09-01" reference = "https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/" description = "Detects NodeRabbit and PollCat RAT components by C2 endpoint paths, persistence artefact names and lure-specific strings observed in the Mirage Kitten coding-challenge campaign" strings: $ep_rabbit_checkin = "/api/rabbit/checkin" $ep_rabbit_task = "/api/rabbit/task" $ep_rabbit_result = "/api/rabbit/result" $ep_sdk_ready = "/sdk/v2/ready" $ep_sdk_config = "/sdk/v2/config" $ep_sdk_events = "/sdk/v2/events" $ep_beacon = "/beacon" $ep_gate_hello = "/gate/hello" $ep_gate_fetch = "/gate/fetch" $ep_gate_submit = "/gate/submit" $ep_vault_push = "/vault/push/" $ep_sysdetails = "/api/system-details/result" $cmd_sysinfo = "sys:info" $cmd_procstart = "proc:start" $cmd_scriptexec = "script:exec" $cmd_agent_servers = "agent:servers" $cmd_outlook = "outlook:emails" $cmd_persist_vscode = "persist:vscode" $cmd_project_inject = "persist:project:inject" $shepherd_marker = "# shepherd-persist;" $task_intel = "IntelDriverSupportUpdate" $task_netsync = "NetSync_" $runkey_edge = "MicrosoftEdgeUpdate" $file_msedge = "msedge_update.js" $file_idriver = "idriver_support.js" $file_requireobj = "requireObjects.js" $file_requireauth = "requireAuth.js" $file_svjson = ".sv.json" $file_launchervbs = "launcher.vbs" $pkg_colorized = "colorized_terminal" $pkg_prettylog = "pretty-log" $ext_copilot = "GitHub Copilot Helper" $ext_desc = "AI coding assistant helper service" $activation = "onStartupFinished" $plist_edge = "com.microsoft.edgeupdate.plist" $plist_intel = "com.intel.dsa.helper" $plist_harsh = "com.harsh.requireobject.plist" $json_d_field = "\"_r\"" $json_t_field = "\"_t\"" condition: uint16(0) == 0x4d5a or filesize < 5MB ) and 5 of ($ep_*, $cmd_*, $pkg_*, $ext_*, $task_*, $file_*, $plist_*, $shepherd_marker, $runkey_edge, $activation, $json_*) } ``` Note: the `$ep_*`, `$cmd_*`, `$pkg_*` and `$json_*` strings are protocol/behaviour artefacts of the malware's own code and C2 traffic; the `$ext_*`, `$task_*`, `$file_*`, `$plist_*`, `$runkey_edge` and `$shepherd_marker` strings are the exact persistence artefact names the malware creates. The condition requires five distinct artefact families to fire, limiting false positives on benign Node.js projects. ```yaml title: NodeRabbit/PollCat Persistence Artefacts - Mirage Kitten Coding Challenge Campaign id: 7c2f1a34-9e58-4d21-b0aa-1f5e8c93d702 status: experimental description: Detects scheduled-task creation, Run-key persistence and proxy-auth child processes used by NodeRabbit and PollCat RATs delivered via trojanized coding challenge archives (Kaspersky GReAT, 2026-09-01). references: - https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/ author: Adverse Trace date: 2026-09-01 tags: - attack.persistence - attack.t1053.005 - attack.t1547.001 logsource: product: windows service: scheduled-task or process_creation detection: selection_task_name: EventID: 4698 TaskName: - 'IntelDriverSupportUpdate' - 'NetSync_*' selection_task_command: EventID: 4698 |: - '*idriver_support.js*' - '*requireObject.js*' - '*msedge_update.js*' - '*launcher.vbs*' selection_run_key: EventID: 4657 TargetObject|contains: '\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdate' selection_curl_proxyauth: ParentImage|endswith: '\node.exe' Image|endswith: '\curl.exe' CommandLine|contains|all: - '--proxy-anyauth' - '--proxy-user' selection_wsl_relaunch: Image|endswith: '\wscript.exe' CommandLine|contains: 'launcher.vbs' condition: 1 of selection_* falsepositives: - Legitimate Intel Driver & Support Assistant tasks (verify task action points to IntelDSA.exe with a .js argument before escalation) - Developer tooling invoking curl with proxy flags (verify parent is node.exe and flags match exactly) level: high ``` ## 7\. Sources - Kaspersky Securelist (GReAT) — "Mirage Kitten switches to Node.js and JavaScript malware" — https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/ — 2026-09-01 - Kaspersky Securelist (GReAT) — "Mirage Kitten targets Middle East and Africa region with new malware" (related toolset: NightLedger, ArcBridge, BridgeHead; MiniFast/Retrograde overlap) — https://securelist.com/mirage-kitten-new-tools/120811/ — (corpus context) - The Record (Recorded Future) — "Iranian cyber spies target aviation, fintech developers with new malware" — https://therecord.media/iranian-cyber-spies-target-aviation-fintech-new-malware — (corroborates discovery geography only) ## 8\. Adverse Trace position This is a capable, well-engineered espionage campaign aimed squarely at the developer population of FinTech, aviation and aerospace organisations in EMEA-adjacent regions, and its delivery vector — fake recruiter contact pressuring execution of a "coding challenge" — is directly transferable to any EMEA financial services client with engineers active on LinkedIn or job platforms; the absence of any CVE means patching is irrelevant and exposure is a function of people, process and endpoint telemetry on non-Windows platforms, which is where most financial-sector detection coverage is thinnest. Severity: high for clients with software engineering staff in or doing business with the Middle East and Africa; moderate elsewhere. Attribution to Mirage Kitten is unconfirmed in our verified reference data (no MITRE ATT&CK profile) and the technical dataset is single-sourced from Kaspersky GReAT — treat the IOC set as high-value but verify before enforcement action such as wholesale azurewebsites.net blocking. We will continue tracking this actor's infrastructure, monitor for a second Kaspersky instalment covering PollCat in depth (the report states further analysis is forthcoming), and update clients if the additional IoCs referenced as available through Kaspersky's commercial reporting surface or if independent corroboration of the attribution emerges. --- [Read the original source →](https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*