Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set

2026-09-02T08:51:47Z5853f7efa48a007478b134f3a30ac3d4f39e505c53bdffb792b79102e2282743
APTAndroid malwareArmored LikhoCoolClientDNS-based C2Google Apps Script C2Head MareHoneyMyteMirage KittenNodeRabbitPhantomCorePhantomGraphPollCatProject CAV3RNStill ToolkitTrueConfValleyRATbackdoorcyber-espionageindustrial control systemskernel rootkitmalwareproxy botnetransomwarevulnerability exploitation

What happened

Kaspersky Securelist reports on major 2026 cyber-threat activity, including Mirage Kitten malware targeting aviation and FinTech organizations in the Middle East and Africa, ValleyRAT distributed as adware, Android malware targeting DoFun vehicle head units, a HoneyMyte CoolClient variant with a kernel-level rootkit, Armored Likho espionage against Telegram users, Head Mare exploitation of unpatched TrueConf servers, and Project CAV3RN using Google Apps Script and DNS-based C2. The feed also includes Q2 2026 threat and vulnerability statistics for industrial control systems, endpoints, IoT, AI

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
kaspersky_securelist
Record identifier
5853f7efa48a007478b134f3a30ac3d4f39e505c53bdffb792b79102e2282743
Enrichment time
2026-09-02T08:51:47Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.