Skip to content

Fox Kitten

Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.

ATT&CK ID: G0117
Origin: Iran
Weather family: Sandstorm
Techniques: 31
Tools: 5

Also tracked as UNC757 · Parisite · Pioneer Kitten · RUBIDIUM · Lemon Sandstorm

Techniques

Resource Development

Establish Accounts

Initial Access

Valid Accounts Exploit Public-Facing Application

Execution

Scheduled Task/Job Command and Scripting Interpreter

Persistence

Scheduled Task/Job Valid Accounts Create Account Server Software Component Event Triggered Execution

Privilege Escalation

Scheduled Task/Job Valid Accounts Event Triggered Execution

Stealth

Obfuscated Files or Information Masquerading Valid Accounts

Credential Access

OS Credential Dumping Brute Force Unsecured Credentials Credentials from Password Stores

Discovery

Query Registry Remote System Discovery Network Service Discovery File and Directory Discovery Account Discovery Browser Information Discovery

Lateral Movement

Remote Services Exploitation of Remote Services

Collection

Data from Local System Data from Network Shared Drive Data from Information Repositories Data from Cloud Storage Archive Collected Data

Command and Control

Proxy Web Service Ingress Tool Transfer Protocol Tunneling

Software

China Chopper · Pay2Key · PsExec · SystemBC · ngrok

MITRE ATT&CK All threat actors