FlagThis

← All Threat Actors
Threat Actor Profile

Fox Kitten

G0117 Lemon Sandstorm PARISITE PIONEER KITTEN RUBIDIUM UNC757
▲ High Threat
PIONEER KITTEN is an Iran-based adversary that has been active since at least 2017 and has a suspected nexus to the Iranian government. This adversary appears to be primarily focused on gaining and maintaining access to entities possessing sensitive information of likely intelligence interest to the Iranian government. According to DRAGOS, they also targeted ICS-related entities using known VPN vulnerabilities. They are widely known to use open source penetration testing tools for reconnaissance and to establish encrypted communications.
Origin Iran

Known TTPs

Ingress Tool Transfer
Command and Scripting Interpreter
Data from Cloud Storage
Remote System Discovery
Brute Force
Exploitation of Remote Services
Local Account
Archive via Utility
Command Obfuscation
Data from Local System
Establish Accounts
VNC
Credentials In Files
Browser Information Discovery
Windows Command Shell
Encrypted/Encoded File
Messaging Applications
SMB/Windows Admin Shares
Exploit Public-Facing Application
Password Managers
NTDS
Local Account
Domain Account
SSH
Web Shell
Scheduled Task
Masquerade Task or Service
LSASS Memory
Proxy
Query Registry
Protocol Tunneling
Remote Desktop Protocol
Web Service
Data from Network Shared Drive
Valid Accounts
Network Service Discovery
Accessibility Features
Social Media Accounts
Match Legitimate Resource Name or Location
PowerShell
File and Directory Discovery

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…
LINK COPIED TO CLIPBOARD