Ajax Security Team
Ajax Security Team is a group that has been active since at least 2010 and believed to be operating out of Iran. By 2014 Ajax Security Team transitioned from website defacement operations to malware-based cyber espionage campaigns targeting the US defense industrial base and Iranian users of anti-censorship technologies.
- ATT&CK ID
- G0130
- Origin
- Iran
- Techniques
- 5
- Tools
- 2
Also tracked as Operation Woolen-Goldfish · AjaxTM · Rocket Kitten · Flying Kitten · Operation Saffron Rose
Techniques
Initial Access
Execution
Credential Access
Input CaptureCredentials from Password Stores
Collection
Command and Control
Software
Havij · sqlmap