Iranian cyber spies target aviation, fintech developers with new malware
Kaspersky links Iranian espionage group Mirage Kitten to fake job offers delivering new NodeRabbit and PollCat malware at aviation and fintech targets.
Kaspersky attributes the campaign to Iran-linked Mirage Kitten (also tracked as UNC1549, Smoke Sandstorm and Nimbus Manticore), which targeted developers and specialists in Egypt, Ethiopia and Afghanistan via fake recruiter contacts on LinkedIn and job platforms. Victims were lured into running malicious coding assessments that deployed two previously unknown families: NodeRabbit, a cross-platform RAT for Windows, Linux and macOS, and PollCat, which provides persistence and delivers additional payloads. The group masks activity behind legitimate Microsoft Azure and Cloudflare infrastructure, sometimes embedding victim organization names in Azure subdomains. The group has been active since at least 2022, focusing on aviation, aerospace and financial technology sectors in Africa and the Middle East.
- NodeRabbit RAT infects Windows, Linux and macOS systems
- Fake recruiters on LinkedIn push coding assignments containing hidden malware
- One test banned AI assistants, possibly to prevent detection of malicious code
- Group abuses Azure and Cloudflare infrastructure, embedding victim names in subdomains
- Mirage Kitten active since 2022, focused on aviation and fintech sectors
- Products
- Azure
- Threat actors
- Mirage KittenUNC1549Smoke SandstormNimbus Manticore
- Malware
- NodeRabbitPollCat
- Organizations
- Countries
- IranEgyptEthiopiaAfghanistan
From the original article
3 min read at therecord.media
An Iran-linked cyberespionage group is targeting technology specialists in the aviation, aerospace and financial sectors with fake job offers designed to trick them into installing previously undocumented malware, according to new research.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.