Nemesis Kitten
Nemesis Kitten is an Iranian threat actor / intrusion set associated with the APT35 cluster. The content states it is operated by the private companies Afkar System and Najee Technologies, which the U.S. Treasury assessed were contracted by the IRGC-IO, making it an Iranian nation-state-linked actor. The actor is also referred to in the content as TunnelVision and Cobalt Mirage, and one report describes TunnelVision as an Iranian-aligned cluster with attribution overlap or confusion involving Charming Kitten and Nemesis Kitten. The content also notes a late-2022 report describing Nemesis Kitten as an Iranian nation-state sub-cluster that used GitHub to deliver a backdoor called Drokbk. Across the provided material, Nemesis Kitten is linked to exploitation of widely known vulnerabilities and to ransomware- and espionage-related activity. One strategic report states Nemesis Kitten has been linked to lucrative cyber operations including ransomware and crypto-mining. Another mention describes Nemesis Kitten as engaging in ransomware attacks disguised as hacktivism, including exfiltrating data before encryption and leaking stolen data. The content also places Nemesis Kitten among Iranian intrusion sets that target sectors such as energy, telecommunications, maritime transportation, critical infrastructure, and individuals in NGOs, think tanks, and academia, although the content does not provide a Nemesis-Kitten-specific victimology breakdown beyond those broader Iran-nexus trends. The content further associates overlapping or related activity with use of GitHub and other public services, and with exploitation of 1-day vulnerabilities. In the TunnelVision reporting, the cluster operated in the Middle East and the U.S., exploited Fortinet FortiOS CVE-2018-13379, Microsoft Exchange ProxyShell, Log4Shell, and VMware Horizon Log4j vulnerabilities, and used PowerShell, reverse shells, credential harvesting, lateral movement, backdoors, backdoor-user creation, and tunneling tools such as FRPC, Plink, and Ngrok. TunnelVision also used legitimate services including transfer.sh, pastebin.com, webhook.site, ufile.io, raw.githubusercontent.com, and a GitHub repository to support operations. However, the content explicitly frames TunnelVision as a separate tracking name used because of attribution overlap with Microsoft Phosphorus and vendor naming overlap involving Charming Kitten and Nemesis Kitten. The content also states Nemesis Kitten was among the more commonly observed threat actors exploiting top routinely exploited vulnerabilities in 2022, and that its TTPs overlap with other established Iranian APTs such as Tortoiseshell and Charming Kitten.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Suspected IRGC-affiliated ransomware operator using hacktivist branding and psychological operations; employs data theft + encryption + leak (double extortion) to undermine confidence in critical infrastructure.
Referenced as an established Iranian APT with TTP overlap to RedKitten; mentioned in references in connection with the Drokbk backdoor (not described in-body).
Iranian nation-state group referenced for prior use of GitHub as a delivery conduit for a backdoor (Drokbk), providing precedent for the GitHub dead-drop technique.
Nemesis Kitten is a threat actor group that exploited several of the top twelve most exploited vulnerabilities in 2022, focusing on opportunistic attacks against unpatched systems.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.