RedKitten

No known aliases in database

▲ High Threat

Iranian Protest Suppression Campaign

Origin Iran

Sponsor Iranian government (aligned with state security interests)

Motivation Espionage and the suppression of political dissent and human rights documentation.

Target Sectors

Human rights NGOs Human rights activists Political dissidents Policy influencers Diplomatic missions and embassies

Spear-phishing via weaponized XLSM documents

LLM-assisted malware and VBA code generation

AppDomainManager injection

C#-based implants (SloppyMIO)

Command and Control (C2) via Telegram bots and accounts

Payload and configuration retrieval via GitHub and Google Drive

Delivery via 7-Zip archives with Farsi filenames

CISA Advisories ↗

Hacking the mainframe…