MITRE ATT&CKgroup
G0117 Fox Kitten
- Domain
- enterprise
- Aliases
- UNC757, Parisite, Pioneer Kitten, RUBIDIUM, Lemon Sandstorm
- Version
- 2.0
- Created
- 2020-12-21
Description
Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.
Related
Uses · MITRE ATT&CK (46)
- S9001 SystemBC software (malware)
- T1213.005 Messaging Applications sub-technique
- T1027.013 Encrypted/Encoded File sub-technique
- S0508 ngrok software (tool)
- T1027.010 Command Obfuscation sub-technique
- T1555.005 Password Managers sub-technique
- S0556 Pay2Key software (malware)
- T1585 Establish Accounts technique
- T1585.001 Social Media Accounts sub-technique
- T1572 Protocol Tunneling technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1087.001 Local Account sub-technique
- T1087.002 Domain Account sub-technique
- T1560.001 Archive via Utility sub-technique
- T1003.001 LSASS Memory sub-technique
- T1003.003 NTDS sub-technique
- T1021.001 Remote Desktop Protocol sub-technique
- T1021.002 SMB/Windows Admin Shares sub-technique
- T1021.004 SSH sub-technique
- T1021.005 VNC sub-technique
- T1036.004 Masquerade Task or Service sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1552.001 Credentials In Files sub-technique
- T1136.001 Local Account sub-technique
- T1546.008 Accessibility Features sub-technique
- T1505.003 Web Shell sub-technique
- T1053.005 Scheduled Task sub-technique
- T1530 Data from Cloud Storage technique
- T1190 Exploit Public-Facing Application technique
References
- https://us-cert.cisa.gov/ncas/alerts/aa20-259a CISA AA20-259A Iran-Based Actor September 2020
- https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf ClearSky Pay2Kitten December 2020
- https://www.clearskysec.com/fox-kitten/ ClearkSky Fox Kitten February 2020
- https://www.dragos.com/threat/parisite/ Dragos PARISITE
- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide Microsoft Threat Actor Naming July 2023
- https://www.crowdstrike.com/blog/who-is-pioneer-kitten/ CrowdStrike PIONEER KITTEN August 2020