#ParsedReport #CompletenessHigh
01-09-2026

Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set

https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/

Report completeness: High

Actors/Campaigns:
Tortoiseshell (motivation: cyber_espionage)

Threats:
Noderabbit
Spear-phishing_technique
Pollcat
Dllsearchorder_hijacking_technique
Hook_injection_technique
Minifast

Victims:
Financial technology, Aviation, Aerospace

Industry:
Aerospace, Software_development, Financial

Geo:
Egypt, Afghanistan, Ethiopia, Ireland, Africa, Israel, Germany, Iraq, India, Middle east

TTPs:
Tactics: 2
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1016, T1027, T1033, T1036.005, T1041, T1057, T1059.007, T1071.001, T1082, T1083, have more...

IOCs:
Hash: 12
Url: 2
File: 26
Path: 4
Registry: 1
Domain: 38

Soft:
Node.js, Linux, macOS, curl, WinHTTP, crontab, Outlook, vscode, Microsoft Outlook, onlyoffice, have more...

Algorithms:
zip, sha256, aes-256-gcm, base64, aes, md5

Functions:
TaskFlow, Task-FullStack

Win API:
WinHttpQueryAuthSchemes, WinHttpSetCredentials

Languages:
javascript

Platforms:
x86, intel, cross-platform