Fox Kitten
Also reported as Lemon Sandstorm, UNC757, RUBIDIUM, PIONEER KITTEN, Parisite and 5 other names. Linked to Iran by four sources.
Reports per quarter
Techniques seen in the last two years
- T1056 2 reports reports only
- T1059.001 2 reports in ATT&CK
- T1078.002 2 reports reports only
- T1133 2 reports reports only
- T1219 2 reports reports only
- T1505.003 2 reports in ATT&CK
- T1572 2 reports in ATT&CK
- T1003 1 report reports only
- T1003.001 1 report in ATT&CK
- T1003.002 1 report reports only
Show all 28 techniques Show fewer
- T1012 1 report in ATT&CK
- T1021.001 1 report in ATT&CK
- T1021.002 1 report in ATT&CK
- T1021.004 1 report in ATT&CK
- T1053 1 report reports only
- T1053.005 1 report in ATT&CK
- T1056.003 1 report reports only
- T1070.006 1 report reports only
- T1078.003 1 report reports only
- T1098 1 report reports only
- T1136.001 1 report in ATT&CK
- T1190 1 report in ATT&CK
- T1218 1 report reports only
- T1482 1 report reports only
- T1505 1 report reports only
- T1556.002 1 report reports only
- T1596 1 report reports only
- T1657 1 report reports only
Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.
Also listed by ATT&CK
CVEs named in reports
- CVE-2017-11882 KEV ransomware
- CVE-2018-13379 KEV ransomware
- CVE-2018-1579
- CVE-2019-0604 KEV ransomware
- CVE-2019-0708 KEV ransomware
- CVE-2019-11510 KEV ransomware
- CVE-2019-11539 KEV ransomware
- CVE-2019-1367 KEV ransomware
- CVE-2019-1579 KEV ransomware
- CVE-2019-17026 KEV
- CVE-2019-19781 KEV ransomware
- CVE-2019-2215 KEV
Show all 55 CVEs Show fewer
- CVE-2019-5591 KEV ransomware
- CVE-2020-0674 KEV
- CVE-2020-0688 KEV ransomware
- CVE-2020-10189 KEV
- CVE-2020-11901
- CVE-2020-12812 KEV ransomware
- CVE-2020-1472 KEV ransomware
- CVE-2020-1472122
- CVE-2020-2021 KEV ransomware
- CVE-2020-5902 KEV ransomware
- CVE-2020-6418 KEV
- CVE-2020-6819 KEV
- CVE-2020-6820 KEV
- CVE-2020-8467 KEV
- CVE-2020-8468 KEV
- CVE-2021-26855 KEV ransomware
- CVE-2021-26857 KEV ransomware
- CVE-2021-26858 KEV ransomware
- CVE-2021-27065 KEV ransomware
- CVE-2021-31207 KEV ransomware
- CVE-2021-31979 KEV
- CVE-2021-3197961
- CVE-2021-33771 KEV
- CVE-2021-3377162
- CVE-2021-34473 KEV ransomware
- CVE-2021-34523 KEV ransomware
- CVE-2021-35211 KEV ransomware
- CVE-2021-44228 KEV ransomware
- CVE-2021-45046 KEV ransomware
- CVE-2022-1388 KEV ransomware
- CVE-2022-42475 KEV ransomware
- CVE-2023-27997 KEV ransomware
- CVE-2023-3519 KEV ransomware
- CVE-2023-38950 KEV
- CVE-2023-3895037
- CVE-2023-38951
- CVE-2023-3895138
- CVE-2023-38952
- CVE-2023-3895239
- CVE-2024-21887 KEV ransomware
- CVE-2024-24919 KEV ransomware
- CVE-2024-30088 KEV ransomware
- CVE-2024-3400 KEV ransomware
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
Show all 41 reports Show fewer
-
COBALT MIRAGE Conducts Ransomware Operations in U.S.
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor COBALT MIRAGE Conducts Ransomware Operations in U.S.
-
Microsoft Digital Defense Report OCTOBER 2021
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Microsoft Digital Defense Report OCTOBER 2021
-
N3TW0RM ransomware emerges in wave of cyberattacks in Israel
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor N3TW0RM ransomware emerges in wave of cyberattacks in Israel
-
The_CrowdStrike_2021_Global_Threat_Report
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The_CrowdStrike_2021_Global_Threat_Report
-
Ngrok Platform Abused by Hackers to Deliver a New Wave of Phishing Attacks
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ngrok Platform Abused by Hackers to Deliver a New Wave of Phishing Attacks
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Pay2Kitten report
-
2020.10.15_Operation_Quicksand_MuddyWater’s_Offensive_Attack_Against_Israeli
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2020.10.15_Operation_Quicksand_MuddyWater’s_Offensive_Attack_Against_Israeli
-
Alert (AA20-259A)- Iran-Based Threat Actor Exploits VPN Vulnerabilities
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Alert (AA20-259A)- Iran-Based Threat Actor Exploits VPN Vulnerabilities
-
Iranian hackers are selling access to compromised companies on an underground forum
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Iranian hackers are selling access to compromised companies on an underground forum
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Who Is PIONEER KITTEN-
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Who Is PIONEER KITTEN-
-
FBI says an Iranian hacking group is attacking F5 networking devices
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor FBI says an Iranian hacking group is attacking F5 networking devices
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 0628-2020APT上半年报告-画册
-
The ICS Threat Landscape and Activity Groups
The original link failed its last check. Original publisher Detailsfor The ICS Threat Landscape and Activity Groups
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Fox Kittens report 16.2.2020
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor PARISITE
-
North American Electric Cyber Threat Perspective
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor North American Electric Cyber Threat Perspective
Newest first. Details opens the report in Explore.