BridgeHead sandbox evasion via advapi32.dll GetUserNameA username check

Ethan Andrews@eandrews

•updated Jul 28, 2026•0•0•5

Detects specific DLLs associated with the BridgeHead tunneler (a tool attributed to the threat group Mirage Kitten) loading advapi32.dll. This dynamic loading behavior is consistent with the malware attempting to resolve and call the GetUserNameA function to verify the execution environment username, a technique commonly used to detect and evade automated sandbox analysis.