Malware News Kaspersky says Mirage Kitten is still targeting aviation and FinTech sectors across the Middle East and Africa this time with a new malware set.

[Khushal]

Content source

https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/

While monitoring Mirage Kitten activity, we uncovered a previously undocumented malware family that we dubbed NodeRabbit. We identified the first sample on a system in Afghanistan. Further threat hunting revealed two additional, more advanced, variants: one on a system in Egypt and another on a system in Ethiopia.

NodeRabbit is a cross-platform remote access trojan (RAT) built with Node.js. It targets Windows, Linux, and macOS. Its operators deliver it through spear-phishing messages on LinkedIn and other job search platforms that contain trojanized coding challenge archives.

During the same investigation, we discovered another previously undocumented malware family that we dubbed PollCat. Like NodeRabbit, PollCat is a cross-platform RAT, but it is written in obfuscated JavaScript also distributed through trojanized coding challenge archives.

Mirage Kitten has historically relied on native malware written in languages such as C, C++, and Go, often deploying it through DLL search-order hijacking. NodeRabbit and PollCat represent the first publicly documented use of Node.js- and JavaScript-based malware by this APT group.

Kaspersky’s products detect this threat as Trojan.JS.MirageKitten.*

Mirage Kitten switches to Node.js and JavaScript malware

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

securelist.com

 

[Bot]

Key Takeaways

The report describes two cross-platform RAT families attributed to Mirage Kitten:

• NodeRabbit is built with Node.js and reportedly targets Windows, Linux, and macOS.
• PollCat is described as obfuscated JavaScript malware with similar delivery methods.
• The primary infection vector is spear-phishing through LinkedIn and other employment platforms.
• The lures are trojanized coding-challenge archives, which can appear relevant to software-development applicants.
• Kaspersky reportedly detects the activity under the Trojan.JS.MirageKitten.* detection family.

This is a useful reminder that JavaScript or Node.js-based malware is not limited to browser attacks. A malicious archive can include a legitimate-looking project together with scripts, bundled runtimes, altered dependencies, or instructions designed to make the victim execute the payload.

Practical Defensive Measures

• Do not execute coding challenges or unknown projects directly on a primary workstation.
• Verify the sender and opportunity through an independent channel before opening attachments.
• Inspect archive contents without running files, especially package scripts, shell files, executables, and unfamiliar dependencies.
• Avoid commands such as npm install, npm run, node, PowerShell, or shell scripts until the project has been reviewed.
• Use a disposable, isolated virtual machine with restricted network access for suspicious technical assignments.
• Keep endpoint protection, operating systems, Node.js, and development tools updated.
• Submit suspicious files or archives to a reputable malware-analysis service such as VirusTotal, while avoiding the upload of confidential source code or personal information.
• Organizations should monitor unusual child processes, outbound connections from Node.js, persistence mechanisms, and execution from temporary or download directories.

A security product detection is useful, but it does not prove that every related archive or domain is malicious, nor does a lack of detection prove safety. The full Securelist report, hashes, filenames, and indicators should be reviewed before drawing conclusions about a particular sample.

Read the full Securelist report for the technical details and reported indicators.

 

[lokamoka820]

I like that their name includes the word "kitten". Today, my two-month-old white and gray kitten fell into my neighbor's house, and he brought her back safe and sound.

 

[papabanana]

I like that their name includes the word "kitten". Today, my two-month-old white and gray kitten fell into my neighbor's house, and he brought her back safe and sound.

i think they want it to be sounds like cute and scary at the same time. hehe