According researchers, the Iranian group Nimbus Manticore (also known as Mirage Kitten, Smoke Sandstorm, UNC1549) is carrying out a series of cyberattacks against organizations in the Middle East, Africa and South Asia, using a previously undocumented backdoor NightLedger and two specialized tunneling tools — BridgeHead and ArcBridge. Reported targets include government entities and small businesses in Jordan and Tanzania, aviation organizations in Pakistan, telecommunications companies in Ethiopia and financial institutions in Burkina Faso. Organizations in the specified sectors and regions should immediately inspect their networks for signs of compromise associated with this toolkit.
Group profile and intrusion tactics
Nimbus Manticore is a group believed to be aligned with Iranian state interests. In various reports by research teams, it appears under the aliases GalaxyGato, Subtle Snail and others. According to a , the exact method of initial access in the current campaign has not yet been determined. However, the group has previously used targeted phishing lures disguised as job offers from well-known brands and recruiting platforms, as well as fake video conferencing pages that redirect victims to malicious archives hosted on third-party file-sharing services.
Technical analysis of the new toolkit
NightLedger backdoor
The key element of the campaign is the NightLedger backdoor, delivered as a DLL library using the DLL side-loading technique. Once executed, the malware establishes an HTTPS connection to the command-and-control server to receive and execute commands. According to the researchers, its functionality is similar to the TWOSTROKE backdoor previously used by the group, indicating evolutionary development of the toolkit rather than building it from scratch.
The set of commands supported by NightLedger covers the full range of cyber-espionage tasks:
- Collecting information about user accounts and host identification
- Launching arbitrary processes and programs
- File system reconnaissance: enumerating directories and logical drives, copying and deleting files
- Uploading files to the compromised system and exfiltrating them to the C2 server via HTTP POST
- Collecting network information about the host
- Taking screenshots
- Loading additional DLL modules
- Terminating processes and threads
- Managing the beacon interval for contacting the C2 server
- Collecting the diagnostic file
C:\Windows\debug\NetSetup.log— a log used for troubleshooting domain join issues — together with a list of running processes
The last item merits special attention: collecting the NetSetup.log file indicates a focused interest in the victim’s domain infrastructure — likely for planning further lateral movement within the network.
BridgeHead and ArcBridge tunnellers
In addition to the backdoor, the campaign employs two WebSocket-based tunneling tools. BridgeHead (the file “unbcl.dll”) functions as a SOCKS5 proxy server and has reportedly been found in the networks of organizations in Egypt and Pakistan. According to the researchers, it shares partial functional similarity with the previously known tool MiniFast (also MinUpdate, Retrograde).
The architecture of BridgeHead is noteworthy: the C2 server initiates all tunnel connections by sending binary commands over WebSocket, and the implant merely relays traffic between the targets specified by the server and the WebSocket channel. In effect, the compromised machine becomes a relay node: the operator runs tools on the server side, and all resulting TCP traffic passes through the victim’s machine, blending in with the organization’s legitimate network traffic.
ArcBridge is the second WebSocket tunneling tool which, according to Kaspersky, was observed in April 2026 in attacks against targets in the Middle East.
Context and evolution of the toolkit
The use of BridgeHead and ArcBridge fits into the group’s consistent pattern of relying on specialized tunneling utilities. Nimbus Manticore has previously, apparently, used similar tools LIGHTRAIL and POLLBLEND. The move to using the WebSocket protocol as a transport for tunneling is a logical step: WebSocket traffic is easily disguised as legitimate web connections and often passes freely through corporate firewalls and proxy servers.
The relationship between NightLedger and the previously documented TWOSTROKE backdoor, and between BridgeHead and MiniFast, indicates that the group is not creating tools from scratch, but is instead consistently upgrading its existing code base, making detection more difficult while preserving proven functionality.
Impact assessment
The geographic and sectoral scope of the campaign — from government entities to aviation, telecommunications and the financial sector across six countries — points to large-scale intelligence-gathering objectives. Organizations in the mentioned regions, especially those operating critical infrastructure and processing sensitive data, face the highest risk. The use of DLL side-loading and HTTPS communications complicates detection by standard security solutions.
Security recommendations
- Monitor DLL side-loading: track the loading of atypical DLL libraries by legitimate executables, especially from non-standard directories
- Analyze WebSocket traffic: configure network monitoring tools to detect anomalous WebSocket connections, especially long-lived sessions carrying binary data
- Control access to NetSetup.log: enable auditing of access to the
C:\Windows\debug\NetSetup.logfile — its reading is uncharacteristic for ordinary user processes - Check for SOCKS5 activity: detect unauthorized SOCKS5 proxies in the network, especially on workstations and servers where such functionality is not expected
- Phishing awareness: given the group’s use of employment-themed lures, enhance employee training to recognize targeted phishing, particularly related to job offers and video conference invitations
- Network segmentation: limit opportunities for lateral movement to minimize damage in the event of a single node being compromised
Organizations in the sectors and regions mentioned in the Kaspersky report should conduct a retrospective analysis of network activity, focusing on anomalous WebSocket connections, atypical DLL loading and unauthorized access to Windows diagnostic files. Given that the initial access vector remains unidentified, strengthening controls at all potential entry points — from email to external web services — should be treated as a priority.
