Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set

2026-09-03T08:51:47Z80fa55320b1851f861eb668b1bf8b5fbea6a58ae03c2e46f73705364cb07e9c0
APTAndroid-malwareC2DNS-based-C2FinTechGoogle-Apps-ScriptICSIoTJavaScriptMiddle-East-and-AfricaNode.jsTrueConfadwareaviationbackdoorcyber-espionageexploitindustrial-control-systemskernel-mode-rootkitmalwareproxy-botnetransomwarerootkitthreat-intelligencevulnerability

What happened

Kaspersky Securelist RSS entries covering Q2 2026 threat statistics and multiple targeted campaigns involving previously undocumented malware, backdoors, rootkits, Android adware and proxy botnets, exploitation of an unpatched TrueConf server, Google Apps Script and DNS-based C2, and espionage against aviation, FinTech, Middle Eastern and African organizations, Israel, Telegram users, and video-conferencing participants. The collection also highlights industrial control system threats, vulnerabilities and exploits, including open-source AI frameworks.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
kaspersky_securelist
Record identifier
80fa55320b1851f861eb668b1bf8b5fbea6a58ae03c2e46f73705364cb07e9c0
Enrichment time
2026-09-03T08:51:47Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.