← threat actors
threat actor · not yet in the cluster map
mirage-kitten
also tracked as nimbus manticore 2, unc1549 1
2 stories · 2 in the wild · July 29, 2026 – September 2, 2026
evidence: 2 observed
sectors
- finance 1 · Sep 2
- transport 1 · Sep 2
- government 1 · Jul 29
- telecom 1 · Jul 29
geography
- afghanistan 1 · Sep 2
- egypt 1 · Sep 2
- ethiopia 1 · Sep 2
- iran 1 · Sep 2
- africa 1 · Jul 29
- middle east 1 · Jul 29
- south asia 1 · Jul 29
malware and tools
- noderabbit 1 · Sep 2
- pollcat 1 · Sep 2
- nightledger 1 · Jul 29
attack phases seen
- Initial access 2 · Sep 2
- Command and control 1 · Sep 2
- Persistence 1 · Jul 29
what we reported, newest first, grouped by story
September 2, 2026
- Nimbus Manticore / Mirage Kitten is now cross-platform, delivering the previously undocumented NodeRabbit and PollCat Node.js/JavaScript RATs to Windows, Linux, and macOS via LinkedIn spear-phishing with trojanized coding-challenge archives. Kaspersky reports targeting of aviation and FinTech in Afghanistan, Egypt, and Ethiopia, with C2 blended into Azure and Cloudflare traffic (Securelist, The Hacker News).
· Sep 2 · observed · via phishing email · as nimbus manticore · Threat Activity
July 29, 2026
- Iranian state actor Mirage Kitten (Nimbus Manticore / UNC1549) is deploying a new Windows backdoor, NightLedger, plus two custom WebSocket tunnelers that turn victim systems into covert relays, targeting aerospace, telecom and government across the Middle East, Africa and South Asia (The Hacker News, Securelist).
· Jul 29 · observed · as nimbus manticore, unc1549 · Threat Activity