L’attribution à Mirage Kitten repose sur des similarités structurelles avec le backdoor natif Retrograde/MiniFast.
MiniFast
MiniFast, also known as MiniUpdate and Retrograde, is a 64-bit Windows backdoor attributed to the Iranian IRGC-affiliated threat actor Nimbus Manticore (UNC1549).
Profile source: Mallory opens in a new tabMiniFast
Family profile
MiniFast, also known as MiniUpdate and Retrograde, is a 64-bit Windows backdoor attributed to the Iranian IRGC-affiliated threat actor Nimbus Manticore (UNC1549). It emerged in 2026 as a replacement for MiniJunk in espionage campaigns targeting aviation and software-sector organizations in the United States, Europe, the Middle East, Saudi Arabia, and Australia. MiniFast is deployed through career-themed spearphishing, trojanized installers abusing AppDomain hijacking, and SEO-poisoned websites impersonating legitimate software-download portals. The malware establishes long-term access through scheduled-task persistence and communicates with command-and-control infrastructure over HTTP using structured JSON-based tasking while impersonating Chrome browser traffic. It performs host reconnaissance; enumerates processes, drives, and directories; executes shell commands; manages, uploads, and downloads files; loads DLLs; creates archives; terminates processes; adjusts beacon timing; and can request elevation through Windows runas. Analyses have identified coding characteristics consistent with possible AI-assisted development, although this is an assessment rather than a confirmed development provenance.
Capabilities
- Defense Evasion
- Exfiltration
- Persistence
- Post Exploitation
- Privilege Escalation
- Reconnaissance
Reported operators
Threat actors
2 named in public reportingAttribution of PollCat to Nimbus Manticore is supported by structural, command-fetching, beacon-timing, and command-set similarities between PollCat and MiniFast, a backdoor previously attributed to the group.
MITRE ATT&CK
MiniFast in ATT&CK
27 distinct techniquesTechniques
27 techniques T1090 Proxy T1071.001 Web Protocols T1566 Phishing T1071 Application Layer Protocol T1036 Masquerading T1082 System Information Discovery T1053.005 Scheduled Task T1059.003 Windows Command Shell T1041 Exfiltration Over C2 Channel T1608.006 SEO Poisoning T1489 Service Stop T1083 File and Directory Discovery T1057 Process Discovery T1105 Ingress Tool Transfer T1219 Remote Access Tools T1053 Scheduled Task/Job T1583 Acquire Infrastructure T1566.002 Spearphishing Link T1574.001 DLL T1560 Archive Collected Data T1574 Hijack Execution Flow T1033 System Owner/User Discovery T1553.002 Code Signing T1548 Abuse Elevation Control Mechanism T1027 Obfuscated Files or Information T1497.001 System Checks T1560.001 Archive via Utility
