The PolySwarm Blog

Verticals Targeted: Aerospace, Aviation, Defense, Telecommunications, Government, Financial Services, SMBs
Regions Targeted: Egypt, Jordan, Tanzania, Pakistan, Ethiopia, Burkina Faso
Related Threat Actors: Mirage Kitten
Related Families: NightLedger, BridgeHead, ArcBridge

Executive Summary

New research details the continued evolution of Mirage Kitten, an advanced persistent threat (APT) group conducting cyber-espionage operations across the Middle East and Africa. The campaign introduces three previously undocumented malware families, NightLedger, BridgeHead, and ArcBridge, that provide reconnaissance, command execution, covert tunneling, and persistent post-compromise access capabilities. The findings demonstrate Mirage Kitten's continued investment in bespoke malware development and operational security to support long-term intelligence collection.

Verticals Targeted: Aviation, Aerospace
Regions Targeted: US, Global
Related Threat Actors: Scattered Spider, Refined Kitten, Wicked Panda, Fancy Bear
Related Families: Qilin, LockBit, Cl0p

Executive Summary

Cyber risk in the aviation and aerospace sector is evolving toward ransomware, identity-based intrusion, platform-level disruption, and potential impacts to navigation and satellite-dependent services. Recent reporting on airport disruption in April 2026, combined with the confirmed 2025 Collins Aerospace/MUSE ransomware incident, shows how cyber incidents can rapidly affect passenger processing, baggage handling, scheduling, and broader aviation continuity.