FlagThis

← All Threat Actors
Threat Actor Profile

Ajax Security Team

AjaxTM Flying Kitten G0130 Operation Saffron Rose Operation Woolen-Goldfish Rocket Kitten
▲ High Threat
Strategic Espionage in Saudi Arabia
Origin Iran
Sponsor Government of Iran (likely linked to the IRGC)
Motivation Geopolitical espionage and intelligence gathering to support Iranian national security interests.

Target Sectors

Government agencies Defense Industrial Base Academic institutions Diplomatic missions Human rights organizations Media and Journalism Critical Infrastructure

Known TTPs

Spearphishing
Remote Access Trojans (RATs)
Custom malware development (e.g., Wrapper/Gholee)
User execution of malicious files
Credential theft
Living-off-the-land (LotL) techniques
Deployment of custom backdoors

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…
LINK COPIED TO CLIPBOARD