MITRE ATT&CKgroup
G0130 Ajax Security Team
- Domain
- enterprise
- Aliases
- Operation Woolen-Goldfish, AjaxTM, Rocket Kitten, Flying Kitten, Operation Saffron Rose
- Version
- 1.0
- Created
- 2021-04-14
Description
Ajax Security Team is a group that has been active since at least 2010 and believed to be operating out of Iran. By 2014 Ajax Security Team transitioned from website defacement operations to malware-based cyber espionage campaigns targeting the US defense industrial base and Iranian users of anti-censorship technologies.
Related
Uses · MITRE ATT&CK (8)
- T1204.002 Malicious File sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1566.003 Spearphishing via Service sub-technique
- T1555.003 Credentials from Web Browsers sub-technique
- T1056.001 Keylogging sub-technique
- S0224 Havij software (tool)
- S0225 sqlmap software (tool)
- T1105 Ingress Tool Transfer technique
References
- https://documents.trendmicro.com/assets/wp/wp-operation-woolen-goldfish.pdf TrendMicro Operation Woolen Goldfish March 2015
- https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf Check Point Rocket Kitten
- https://www.crowdstrike.com/blog/cat-scratch-fever-crowdstrike-tracks-newly-reported-iranian-actor-flying-kitten/ CrowdStrike Flying Kitten
- https://iranthreats.github.io/resources/attribution-flying-rocket-kitten/ IranThreats Kittens Dec 2017
- https://www.mandiant.com/sites/default/files/2021-09/rpt-operation-saffron-rose.pdf FireEye Operation Saffron Rose 2013