Adversary Intelligence — 2026-07-30

Iranian IRGC-Linked Nimbus Manticore Deploys NightLedger Backdoor in Six-Nation Espionage Campaign

BLUFNightLedger's relay architecture through six nations' compromised networks degrades Western visibility into IRGC targeting cycles precisely when Iran's regional intelligence collection tempo is accelerating.

Kaspersky's Global Research and Analysis Team disclosed on July 28 a previously undocumented malware set attributed to Mirage Kitten (also tracked as Nimbus Manticore, UNC1549, Smoke Sandstorm, and TA455), an Iran-linked espionage group, including a Windows backdoor named NightLedger and two WebSocket tunneling tools, BridgeHead and ArcBridge 1. NightLedger masquerades as SspiCli.dll for DLL search-order hijacking against the legitimate AppVShNotify.exe process, gathers user and host identity data, executes processes, performs file operations and screenshot capture, enumerates drives, and collects the domain-join diagnostic log NetSetup.log using a custom #%%# delimiter-parsing scheme resembling the group's previously attributed TWOSTROKE backdoor; it communicates with C2 domain realhealthshop[.]com, using tjconsultingservices[.]com as a fallback 12. BridgeHead tunnels through corporate proxies via WebSocket, handling HTTP 407 authentication challenges and Windows SSO with full SOCKS5 support and per-target username validation, while ArcBridge uses embedded configuration blocks to support operator-issued OPEN and DNS commands 1. Kaspersky's telemetry identified confirmed victims in Egypt, government and SMB environments in Jordan and Tanzania, an aviation organization in Pakistan, telecommunications firms in Ethiopia, and financial-sector entities in Burkina Faso 13. BridgeHead's deployment followed spear-phishing activity consistent with tradecraft previously documented by Unit 42 and Check Point Research, including fake recruitment portals and lookalike videoconferencing pages 12.

Analysis
The DLL search-order hijack against AppVShNotify.exe evades tools tuned to standard hijacking patterns, so defenders relying on directory-based DLL monitoring will miss NightLedger absent updated behavioral signatures, and BridgeHead and ArcBridge turn compromised hosts into relay nodes that defeat IP-based blocklists once traffic launders through victim networks. Cloudflare-fronted domains further complicate network-layer attribution, leaving aviation, telecommunications, and financial-sector defenders across the affected states with an immediate indicator-update requirement. Coverage traces to a single Kaspersky technical disclosure that other outlets recirculated without independent corroboration. The toolkit has expanded well beyond the May-documented MiniFast backdoor, and confirmed victims now span Egypt, Jordan, Tanzania, Pakistan, Ethiopia, and Burkina Faso rather than the previously reported US defense and aerospace targets, though this apparent pivot toward Africa and South Asia may instead reflect Kaspersky's telemetry coverage rather than a genuine redirection of the group's targeting priorities.

4 sources

Mirage Kitten's new malware set: NightLedger backdoor and two tunneling tools - Securelist (Kaspersky GReAT)
Iran Deploys NightLedger Backdoor and WebSocket Relays Across Six Nations - Tech Times
Mirage Kitten Unveils NightLedger, BridgeHead, ArcBridge Malware - TechNadu
Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert Relays - The Hacker News