Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set
2026-09-03T08:51:47Z•80fa55320b1851f861eb668b1bf8b5fbea6a58ae03c2e46f73705364cb07e9c0
APTAndroid-malwareC2DNS-based-C2FinTechGoogle-Apps-ScriptICSIoTJavaScriptMiddle-East-and-AfricaNode.jsTrueConfadwareaviationbackdoorcyber-espionageexploitindustrial-control-systemskernel-mode-rootkitmalwareproxy-botnetransomwarerootkitthreat-intelligencevulnerability
What happened
Kaspersky Securelist RSS entries covering Q2 2026 threat statistics and multiple targeted campaigns involving previously undocumented malware, backdoors, rootkits, Android adware and proxy botnets, exploitation of an unpatched TrueConf server, Google Apps Script and DNS-based C2, and espionage against aviation, FinTech, Middle Eastern and African organizations, Israel, Telegram users, and video-conferencing participants. The collection also highlights industrial control system threats, vulnerabilities and exploits, including open-source AI frameworks.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- 80fa55320b1851f861eb668b1bf8b5fbea6a58ae03c2e46f73705364cb07e9c0
- Enrichment time
- 2026-09-03T08:51:47Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.