Mirage Kitten Switches to Node.js and JavaScript Malware
Mirage Kitten Switches to Node.js and JavaScript Malware 🚀
While monitoring Mirage Kitten activity, we uncovered a previously undocumented malware family that we dubbed NodeRabbit. The first sample was identified on a system in Afghanistan, with further threat hunting revealing two additional, more advanced variants: one in Egypt and another in Ethiopia. NodeRabbit is a cross-platform remote access trojan (RAT) built with Node.js, targeting Windows, Linux, and macOS. Its operators deliver it through spear-phishing messages on LinkedIn and other job search platforms that contain trojanized coding challenge archives.
During the same investigation, we discovered another previously undocumented malware family, PollCat, which is also a cross-platform RAT written in obfuscated JavaScript and distributed through trojanized coding challenge archives. NodeRabbit and PollCat represent the first publicly documented use of Node.js- and JavaScript-based malware by this APT group. Kaspersky’s products detect this threat as Trojan.JS.MirageKitten.
Infection Chain 🔗
The infection chain begins with fake recruiter accounts contacting prospective targets on a job search platform. The target receives a link to a coding challenge hosted on Amazon S3 and is pressured to download and run the project immediately. This delivery chain, reconstructed from our telemetry, involves recruiter outreach on a job search platform, a coding challenge as a technical assessment, and a trojanized project archive hosted on legitimate cloud infrastructure. The archive, Front-Technical-Challenge.zip (MD5: 1EA83E4E4592B01E4ACAB63EB867BEE5), was hosted in an Amazon S3 bucket at: https://oracle-challenge.s3[.]us-east-1.amazonaws[.]com/Front-T[REDACTED BY DNB EDITORS TO GET PAST GOOGLE FILTERS]zip.
The first line of server.js imported a trojanized npm package named colorized_terminal, version 2.1.0. When imported, the package silently launched an implant from node_modules/.cache/.320697f1/index.js as a detached background process. The campaign utilized two trojanized packages, colorized_terminal and pretty-log, both pinned to version 2.1.0.
Variants Overview 🦠
The first NodeRabbit variant, discovered on a system in Afghanistan, binds a TCP listener to 127.0.0.1:48739 for a single-instance mechanism and communicates with its command-and-control servers through three API endpoints from Azure-hosted C2 infrastructure. The second NodeRabbit variant, found in Egypt, is more advanced, launched through the trojanized pretty-log package. This variant checks for analysis environments, terminating if it detects limited system memory, low CPU count, or common analysis tools. Variant 2 implements partial corporate proxy support, checking HTTP(S) proxy environment variables and Windows Internet Settings. For persistence, it masquerades as Intel Driver & Support Assistant. The third NodeRabbit variant, identified in Ethiopia, introduces significant changes to its C2 configuration, command set, and persistence mechanisms. It communicates with its C2 infrastructure through different API endpoints and uses a C2 chain composed of Azure- and Cloudflare-hosted domains. This variant adds 12 new commands, totaling 23, and introduces two additional persistence mechanisms: a malicious VS Code extension, displayed as GitHub Copilot Helper, and Git hook injection.
To read the complete article see: Read full article