# Mirage Kitten (UNC1549) deploys new NodeRabbit and PollCat RATs against aviation and FinTech via fake-recruiter coding challenges

> Kaspersky (Securelist, 2026-09-01) reports Mirage Kitten (aka UNC1549, Smoke Sandstorm, Nimbus Manticore) targeting aviation/aerospace and FinTech organizations in the Middle East and Africa, mainly Egypt, Ethiopia and Afghanistan, with two new cross-platform Node.js/JavaScript RATs, NodeRabbit and PollCat. Fake recruiters on job platforms deliver trojanized coding-challenge archives; NodeRabbit is launched via the trojanized npm packages colorized_terminal and pretty-log (v2.1.0).

- **Published:** 2026-10-23T01:08:02Z
- **Last reviewed:** 2026-10-23T01:08:02Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4201
- **ID:** TL-2026-4201
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Mirage Kitten (Iran)
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Kaspersky identified two previously undocumented JavaScript/Node.js RATs, NodeRabbit and PollCat, attributed to the Iran-linked espionage actor Mirage Kitten (tracked elsewhere as UNC1549, Smoke Sandstorm and Nimbus Manticore). They are reported as the group's first publicly documented malware built on Node.js/JavaScript. Targets are software engineers and staff at aviation, aerospace and FinTech organizations in the Middle East and Africa. The first cases were found in Afghanistan, Egypt and Ethiopia. Archive submissions also came from India, Turkey, Israel, Iraq, Germany and Ireland.

Infection chain: a fake recruiter contacts the target on LinkedIn or another job platform and sends a coding-challenge archive. The archive is hosted on Amazon S3, which Securelist describes as a shift from the group's earlier onlyoffice.com delivery. The README steers the victim away from the malicious server.js. A three-hour time limit and a ban on AI assistants discourage code review. A bundled malicious npm package runs on import and launches the implant as a detached background process.

NodeRabbit is cross-platform (Windows, Linux, macOS) and has three reported variants. Variant 1 (Afghanistan) is launched through the trojanized colorized_terminal v2.1.0 package. It runs from node_modules/.cache/.320697f1/index.js, binds a TCP listener on 127.0.0.1:48739, uses AES-256-GCM-encrypted JSON to Azure-hosted C2, and has 11 commands. Variant 2 (Egypt) uses the trojanized pretty-log v2.1.0 package. It adds sandbox detection with benign HEAD requests before it terminates, corporate proxy support with NTLM/Negotiate authentication, a host-derived port (41984 + identifier mod 5000), and persistence under the name 'Intel Driver & Support Assistant'. Variant 3 (Ethiopia) uses /sdk/v2/ready, /sdk/v2/config and /sdk/v2/events endpoints and has 23 commands, including outlook:emails. It persists through a fake 'GitHub Copilot Helper' VS Code extension and Git hooks (post-merge, post-checkout) marked 'shepherd-persist', adds WSL-aware persistence and daily 10AM scheduled tasks, and chains C2 through visitfinancedentists.com, an azurewebsites.net host and healthcomfsdpower.com.

PollCat is delivered as the 'RankChallenge-react' challenge. It is an obfuscated JavaScript RAT that runs at application start-up. Registration treats an unusual HTTP 400 response containing a socketId as success. It declares 22 commands (3 unimplemented) in a little-endian binary, Base64-encoded format, including EVAL_JS, RUNDLL, ZIP and CHUNKED_DOWNLOAD. Default polling is 2 minutes with 5 seconds of jitter. It checks for 24 hard-coded security-vendor folder names. Persistence is a daily 09AM scheduled task under %APPDATA%\Microsoft\Network on Windows, ~/.node_packages with @reboot and daily cron on Linux, and a LaunchAgent on macOS.

Attribution to Mirage Kitten rests on structural overlap with the group's MiniFast/Retrograde backdoor (identical C2 handshake logic treating HTTP 400 as success, shared socketId session setup, 120s poll / 5s jitter / 60s retry defaults, overlapping command IDs, curl.exe-based proxy authentication), consistent geographic targeting, and Azure/Cloudflare infrastructure patterns. Kaspersky detects the malware as Trojan.JS.MirageKitten.*. Earlier public reporting (Mandiant/Google, Feb 2024) describes UNC1549 as active since at least June 2022, using Azure-hosted C2, job-themed lures and the MINIBIKE/MINIBUS backdoors against aerospace, aviation and defense. No CVE is involved.

## MITRE ATT&CK

- T1585.001 Social Media Accounts
- T1583.001 Domains
- T1583.006 Web Services
- T1566.003 Spearphishing via Service
- T1195.001 Compromise Software Dependencies and Development Tools
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1053.003 Cron
- T1543.001 Launch Agent
- T1176.002 IDE Extensions
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1497.001 System Checks
- T1518.001 Security Software Discovery
- T1082 System Information Discovery
- T1057 Process Discovery
- T1114.001 Local Email Collection
- T1560.001 Archive via Utility
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography

## Sources

- [Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set](https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/)
- [SOC Prime: Mirage Kitten Deploys NodeRabbit and PollCat Through Job Offer Lures](https://socprime.com/active-threats/mirage-kitten-deploys-noderabbit-and-pollcat-through-job-offer-lures/)
- [GBHackers: Mirage Kitten campaign](https://gbhackers.com/mirage-kitten-campaign/)
- [The Hacker News: Iran-Linked UNC1549 Hackers Target Middle East Aerospace & Defense Sectors](https://thehackernews.com/2024/02/iran-linked-unc1549-hackers-target.html)
- [SecurityWeek: Iranian Hackers Target Aviation and Defense Sectors in Middle East](https://www.securityweek.com/iranian-hackers-target-aviation-and-defense-sectors-in-middle-east/)
- [CSA Research Note: Nimbus Manticore's NightLedger Backdoor and Covert Relay Network](https://labs.cloudsecurityalliance.org/research/csa-research-note-nimbus-manticore-nightledger-20260729-csa/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4201