Fox Kitten
Fox Kitten is an Iranian threat actor tracked under aliases including Pioneer Kitten, Rubidium, Lemon Sandstorm, UNC757, Br0k3r, and Parisite. The content describes this group as Iranian actors that have targeted U.S. organizations since 2017, including U.S. federal agencies and organizations in the information technology, government, healthcare, financial, insurance, media, education, and defense sectors. Additional reporting in the content states the group has also targeted organizations in Israel, Azerbaijan, and the United Arab Emirates, and has been linked by U.S. agencies to Iranian government interests while also pursuing financial gain. The content further states the actors have coordinated with ransomware affiliates including NoEscape, Ransomhouse, and AlphV, and were attributed to the 2020 Pay2Key ransomware operation. According to the content, Fox Kitten commonly gains initial access by mass-scanning internet-facing systems and exploiting known vulnerabilities in products including Pulse Secure VPN, Citrix NetScaler, F5 BIG-IP, Check Point, Palo Alto Networks, and Ivanti. Reported exploited vulnerabilities include CVE-2019-11510, CVE-2019-11539, CVE-2019-19781, CVE-2020-5902, CVE-2024-24919, CVE-2024-3400, CVE-2022-1388, and CVE-2023-3519. The group has used Nmap and Shodan to identify vulnerable systems and open ports. Post-compromise, the content states Fox Kitten obtained administrator-level credentials, installed web shells including ChunkyTuna, Tiny, and China Chopper, and maintained persistence for months. Persistence and defense evasion tradecraft described in the content includes Scheduled Tasks and cron jobs, use of a task named lpupdate, use of cmd.exe likely as a password-changing mechanism, use of sticky keys via sethc.exe, base64-encoded payloads, and masquerading FRPC-related files as svhost/svchost and dllhost or dllhost.dll. The group used a Perl reverse shell for command-and-control and used FRPC, Chisel, and ngrok for tunneling and remote access. The content attributes broad discovery, credential access, and collection activity to Fox Kitten. This includes use of Angry IP Scanner to detect remote systems; Nmap for broad scanning and open-port identification; Google Chrome bookmarks to identify internal resources and assets; access to local system resources and sensitive documents; access to files to gain valid credentials; use of PowerShell scripts to access credential data; repeated access to a KeePass database via kee.ps1; access to the ntuser.dat and UserClass.dat registry hives; and use of RDP for login and lateral movement. The content also states the group moved laterally using PsExec, SMB shares, Plink, PuTTY, TightVNC, and likely hijacked legitimate RDP sessions. For collection and likely exfiltration, the group gathered data from local systems, network shared drives, Microsoft Teams, and cloud storage, and used 7-Zip to archive collected data. The content also states the group has sold access to compromised infrastructure on hacker forums and has used victim cloud resources as cover to launch additional attacks.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Energy
- Capital Goods
- Utilities
- Government & Administration
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
- 🇦🇺 Australia
Tradecraft
62 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
28 malware families attributed to this actor across reporting.
23 additional families tracked in Mallory.
Associated vulnerabilities
20 CVEs this actor has used in observed campaigns. 20 of them exploited in the wild.
CISA and the FBI have observed the threat actor exploiting multiple CVEs, including CVE-2019-11510, CVE-2019-11539, CVE-2019-19781, and CVE-2020-5902.
CISA and the FBI have observed the threat actor exploiting multiple CVEs, including CVE-2019-11510, CVE-2019-11539, CVE-2019-19781, and CVE-2020-5902.
The threat actor primarily gained initial access by compromising a Citrix NetScaler remote access server using a publicly available exploit for CVE-2019-19781.
CISA and the FBI have observed the threat actor exploiting multiple CVEs, including CVE-2019-11510, CVE-2019-11539, CVE-2019-19781, and CVE-2020-5902.
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
15 more CVEs tied to this actor tracked in Mallory.
Observables
16 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Iranian APT referenced as collaborating with ransomware groups and at times concealing Iranian affiliation while leveraging extracted data for espionage purposes.
Listed as a threat actor associated with the PowerShell P/Invoke process injection API chain detection and related ATT&CK techniques.
Listed as a threat actor associated with PowerShell execution behavior relevant to this detection analytic.
Listed as a threat actor associated with Azure Active Directory account takeover, persistence, privilege escalation, and related cloud-focused post-compromise activity detected via PowerShell module installation.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.