Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set
2026-09-02T08:51:47Z•5853f7efa48a007478b134f3a30ac3d4f39e505c53bdffb792b79102e2282743
APTAndroid malwareArmored LikhoCoolClientDNS-based C2Google Apps Script C2Head MareHoneyMyteMirage KittenNodeRabbitPhantomCorePhantomGraphPollCatProject CAV3RNStill ToolkitTrueConfValleyRATbackdoorcyber-espionageindustrial control systemskernel rootkitmalwareproxy botnetransomwarevulnerability exploitation
What happened
Kaspersky Securelist reports on major 2026 cyber-threat activity, including Mirage Kitten malware targeting aviation and FinTech organizations in the Middle East and Africa, ValleyRAT distributed as adware, Android malware targeting DoFun vehicle head units, a HoneyMyte CoolClient variant with a kernel-level rootkit, Armored Likho espionage against Telegram users, Head Mare exploitation of unpatched TrueConf servers, and Project CAV3RN using Google Apps Script and DNS-based C2. The feed also includes Q2 2026 threat and vulnerability statistics for industrial control systems, endpoints, IoT, AI
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- 5853f7efa48a007478b134f3a30ac3d4f39e505c53bdffb792b79102e2282743
- Enrichment time
- 2026-09-02T08:51:47Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.