G0117: Fox Kitten
Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.[1][2][3][4]
Security context for executives and security teams
Fox Kitten is an ATT&CK group entry describing a threat actor with a suspected Iranian government nexus, active since at least 2017, with reported targeting across multiple regions and industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering. The decision value is not the name alone: the mapped behaviors emphasize credential theft, remote access, lateral movement, discovery, collection, web shells, tunneling/proxy tools, and ransomware-linked tooling. For leaders, this makes Fox Kitten a useful planning profile for validating whether identity, remote access, Windows administration, and incident response controls can withstand an intrusion that moves from access to credential compromise and operational disruption.
Executive priority
Prioritize this as a resilience and readiness use case for organizations with exposed remote access, Windows domains, industrial/engineering environments, sensitive file shares, or high business dependence on uninterrupted operations. Executives should ask whether the organization can prove control coverage for credential protection, administrative tool abuse, remote service monitoring, ransomware response, and sensitive data collection paths. Because ATT&CK provides no official detection text for this group object, coverage should be demonstrated through local telemetry, control validation, and incident response exercises rather than assumed from threat intelligence naming.
Technical view
SOC, detection engineering, and IR teams should map Fox Kitten relationships to defensible behaviors: LSASS and NTDS credential access; RDP, SMB/admin shares, SSH, and VNC lateral movement; PowerShell and Windows command shell execution; scheduled task persistence/execution; registry, remote system, and network service discovery; local and network share collection; command/file obfuscation; masqueraded tasks, services, names, or locations; and use of China Chopper, PsExec, ngrok, Pay2Key, and SystemBC. The group object itself has no ATT&CK platforms or tactics specified, but the related techniques and software include Windows prominently, with some Linux, macOS, ESXi, IaaS, network device, container, and identity-provider contexts. Validate detections against the behaviors, not just aliases or tool names.
Likely telemetry
- Endpoint process creation and command-line logging for PowerShell, cmd, PsExec-like activity, schtasks, registry queries, and discovery commands
- Windows security events and EDR telemetry for LSASS access, credential dumping indicators, domain controller access, and NTDS.dit access or copying
- Authentication and session logs for RDP, SMB/admin shares, SSH, and VNC, including unusual source-destination patterns and privileged account use
- File, service, scheduled task, and registry change telemetry to identify masquerading, suspicious persistence, and renamed or misplaced binaries
- Network flow, proxy, DNS, and firewall logs for tunneling/proxy behavior, remote service scanning, web shell access patterns, and unusual outbound connectivity
Detection direction
- Build behavior-based coverage for credential access to LSASS and NTDS rather than relying only on malware signatures.
- Tune remote access detections around unusual use of valid accounts over RDP, SMB/admin shares, SSH, and VNC, while accounting for legitimate administrator activity.
- Monitor legitimate tools with dual-use potential, especially PsExec and ngrok, with context such as user, host role, parent process, destination, time of day, and change ticket evidence.
- Correlate discovery commands, service scans, registry queries, and lateral movement attempts into intrusion progressions instead of alerting only on isolated commands.
- Review scheduled tasks, services, and file locations for masquerading patterns, especially where names resemble legitimate resources but appear in unusual paths or with abnormal creators.
Mitigation priorities
- Reduce exposed and unnecessary remote access paths; require strong authentication and restrict administrative protocols to managed access zones where feasible.
- Harden identity and credential protections, especially privileged accounts, domain controllers, LSASS protections, and access to Active Directory database material and backups.
- Limit and monitor administrative tooling such as PsExec; establish allowlists, approved use cases, and audit trails for remote execution.
- Improve segmentation and access control around file shares, engineering/industrial networks, servers, and high-value data stores to reduce lateral movement and collection opportunities.
- Apply secure configuration and monitoring to scheduled tasks, services, web servers, and remote management services.
Additional notes and limits
Fox Kitten has multiple aliases in the supplied ATT&CK data: UNC757, Parisite, Pioneer Kitten, RUBIDIUM, and Lemon Sandstorm. The relationship set links the group to both dual-use administration tools and malware/ransomware-related software, which is important for SOC triage because benign-looking remote administration, tunneling, and scripting activity may be part of the same intrusion pattern. Treat the ATT&CK group as a planning and validation profile, not as evidence that any specific organization is targeted or compromised.
The official group object does not specify platforms, tactics, labels, or detection guidance. Platform and tactic discussion here is derived only from the supplied related software and technique relationships. The supplied relationship context is also truncated for some related descriptions, so defenders should consult the official ATT&CK pages and local telemetry before finalizing detections or risk decisions.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Fox Kitten
Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.[1][2][3][4]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1105 | Ingress Tool Transfer | Fox Kitten has downloaded additional tools including PsExec directly to endpoints.[5] |
| Enterprise | T1059 | Command and Scripting Interpreter | Fox Kitten has used a Perl reverse shell to communicate with C2.[4] |
| Enterprise | T1530 | Data from Cloud Storage | Fox Kitten has obtained files from the victim's cloud storage instances.[5] |
| Enterprise | T1018 | Remote System Discovery | Fox Kitten has used Angry IP Scanner to detect remote systems.[5] |
| Enterprise | T1110 | Brute Force | Fox Kitten has brute forced RDP credentials.[4] |
| Enterprise | T1210 | Exploitation of Remote Services | Fox Kitten has exploited known vulnerabilities in remote services including RDP.[1][2][4] |
| Enterprise | T1136.001 | Local AccountSub-technique | Fox Kitten has created a local user account with administrator privileges.[4] |
| Enterprise | T1560.001 | Archive via UtilitySub-technique | Fox Kitten has used 7-Zip to archive data.[5] |
| Enterprise | T1027.010 | Command ObfuscationSub-technique | Fox Kitten has base64 encoded scripts to avoid detection.[5] |
| Enterprise | T1005 | Data from Local System | Fox Kitten has searched local system resources to access sensitive documents.[5] |
| Enterprise | T1585 | Establish Accounts | Fox Kitten has created KeyBase accounts to communicate with ransomware victims.[4][6] |
| Enterprise | T1021.005 | VNCSub-technique | Fox Kitten has installed TightVNC server and client on compromised servers and endpoints for lateral movement.[5] |
| Enterprise | T1552.001 | Credentials In FilesSub-technique | Fox Kitten has accessed files to gain valid credentials.[5] |
| Enterprise | T1217 | Browser Information Discovery | Fox Kitten has used Google Chrome bookmarks to identify internal resources and assets.[5] |
| Enterprise | T1059.003 | Windows Command ShellSub-technique | Fox Kitten has used cmd.exe likely as a password changing mechanism.[5] |
| Enterprise | T1027.013 | Encrypted/Encoded FileSub-technique | Fox Kitten has base64 encoded payloads to avoid detection.[5] |
| Enterprise | T1213.005 | Messaging ApplicationsSub-technique | Fox Kitten has accessed victim security and IT environments and Microsoft Teams to mine valuable information.[5] |
| Enterprise | T1021.002 | SMB/Windows Admin SharesSub-technique | Fox Kitten has used valid accounts to access SMB shares.[5] |
| Enterprise | T1190 | Exploit Public-Facing Application | |
| Enterprise | T1555.005 | Password ManagersSub-technique | Fox Kitten has used scripts to access credential information from the KeePass database.[5] |
| Enterprise | T1003.003 | NTDSSub-technique | Fox Kitten has used Volume Shadow Copy to access credential information from NTDS.[5] |
| Enterprise | T1087.001 | Local AccountSub-technique | Fox Kitten has accessed ntuser.dat and UserClass.dat on compromised hosts.[5] |
| Enterprise | T1087.002 | Domain AccountSub-technique | Fox Kitten has used the Softerra LDAP browser to browse documentation on service accounts.[5] |
| Enterprise | T1021.004 | SSHSub-technique | Fox Kitten has used the PuTTY and Plink tools for lateral movement.[5] |
| Enterprise | T1505.003 | Web ShellSub-technique | Fox Kitten has installed web shells on compromised hosts to maintain access.[5][4] |
| Enterprise | T1053.005 | Scheduled TaskSub-technique | Fox Kitten has used Scheduled Tasks for persistence and to load and execute a reverse proxy binary.[5][4] |
| Enterprise | T1036.004 | Masquerade Task or ServiceSub-technique | Fox Kitten has named the task for a reverse proxy lpupdate to appear legitimate.[5] |
| Enterprise | T1003.001 | LSASS MemorySub-technique | Fox Kitten has used prodump to dump credentials from LSASS.[5] |
| Enterprise | T1090 | Proxy | Fox Kitten has used the open source reverse proxy tools including FRPC and Go Proxy to establish connections from C2 to local servers.[5][4][6] |
| Enterprise | T1012 | Query Registry | Fox Kitten has accessed Registry hives ntuser.dat and UserClass.dat.[5] |
| Enterprise | T1572 | Protocol Tunneling | Fox Kitten has used protocol tunneling for communication and RDP activity on compromised hosts through the use of open source tools such as ngrok and custom tool SSHMinion.[2][5][4] |
| Enterprise | T1021.001 | Remote Desktop ProtocolSub-technique | Fox Kitten has used RDP to log in and move laterally in the target environment.[5][4] |
| Enterprise | T1102 | Web Service | Fox Kitten has used Amazon Web Services to host C2.[4] |
| Enterprise | T1039 | Data from Network Shared Drive | Fox Kitten has searched network shares to access sensitive documents.[5] |
| Enterprise | T1078 | Valid Accounts | Fox Kitten has used valid credentials with various services during lateral movement.[5] |
| Enterprise | T1046 | Network Service Discovery | Fox Kitten has used tools including NMAP to conduct broad scanning to identify open ports.[5][4] |
| Enterprise | T1546.008 | Accessibility FeaturesSub-technique | Fox Kitten has used sticky keys to launch a command prompt.[5] |
| Enterprise | T1585.001 | Social Media AccountsSub-technique | Fox Kitten has used a Twitter account to communicate with ransomware victims.[4] |
| Enterprise | T1036.005 | Match Legitimate Resource Name or LocationSub-technique | Fox Kitten has named binaries and configuration files svhost and dllhost respectively to appear legitimate.[5] |
| Enterprise | T1059.001 | PowerShellSub-technique | Fox Kitten has used PowerShell scripts to access credential data.[5] |
| Enterprise | T1083 | File and Directory Discovery | Fox Kitten has used WizTree to obtain network files and directory listings.[5] |
Groups, software, and campaigns
S0020: China Chopper
S0556: Pay2Key
Pay2Key is a ransomware written in C++ that has been used by Fox Kitten since at least July 2020 including campaigns against Israeli companies. Pay2Key has been incorporated with a leak site to display stolen sensitive information to further pressure victims into payment.[1][2]
S0508: ngrok
S0029: PsExec
S9001: SystemBC
SystemBC is a malware family offered as a malware-as-a-service (MaaS) that is used to establish command and control and facilitate follow-on activity, including ransomware deployment.SystemBC executes a variety of tasks including setting up SOCKS5 proxies, maintaining persistence, ingesting malicious files, and handing C2 communication. SystemBC was first detected in 2018, and has been used by Wizard Spider since at least 2020, and by FIN7 since at least 2022.[1][2][3][4][5]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 2.0 | Current bundle | 99cde31d2ff5… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]ClearkSky Fox Kitten February 2020
ClearSky. (2020, February 16). Fox Kitten – Widespread Iranian Espionage-Offensive Campaign. Retrieved December 21, 2020.
Open source URL - [2]CrowdStrike PIONEER KITTEN August 2020
Orleans, A. (2020, August 31). Who Is PIONEER KITTEN?. Retrieved December 21, 2020.
Open source URL - [3]Dragos PARISITE
Dragos. (n.d.). PARISITE. Retrieved December 21, 2020.
Open source URL - [4]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [5]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [6]Check Point Pay2Key November 2020
Check Point. (2020, November 6). Ransomware Alert: Pay2Key. Retrieved January 4, 2021.
Open source URL - [7]FortinetEtAl_IranianIntrusion_Mar2025
Robson, M., et al. (2025, March 7). Investigating Iranian Intrusion into Strategic Middle East Critical Infrastructure. Retrieved June 18, 2025.
Open source URL - [8]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [9]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [10]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [11]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [12]ClearkSky Fox Kitten February 2020
ClearSky. (2020, February 16). Fox Kitten – Widespread Iranian Espionage-Offensive Campaign. Retrieved December 21, 2020.
Open source URL - [13]ClearkSky Fox Kitten February 2020
ClearSky. (2020, February 16). Fox Kitten – Widespread Iranian Espionage-Offensive Campaign. Retrieved December 21, 2020.
Open source URL - [14]CrowdStrike PIONEER KITTEN August 2020
Orleans, A. (2020, August 31). Who Is PIONEER KITTEN?. Retrieved December 21, 2020.
Open source URL - [15]CrowdStrike PIONEER KITTEN August 2020
Orleans, A. (2020, August 31). Who Is PIONEER KITTEN?. Retrieved December 21, 2020.
Open source URL - [16]Dragos PARISITE
Dragos. (n.d.). PARISITE. Retrieved December 21, 2020.
Open source URL - [17]Dragos PARISITE
Dragos. (n.d.). PARISITE. Retrieved December 21, 2020.
Open source URL - [18]Lemon Sandstorm
(Citation: Microsoft Threat Actor Naming July 2023)
- [19]Lemon Sandstorm
(Citation: Microsoft Threat Actor Naming July 2023)
- [20]Lemon Sandstorm
(Citation: Microsoft Threat Actor Naming July 2023)
- [21]Microsoft Threat Actor Naming July 2023
Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
Open source URL - [22]Microsoft Threat Actor Naming July 2023
Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
Open source URL - [23]Microsoft Threat Actor Naming July 2023
Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
Open source URL - [24]Parisite
(Citation: Dragos PARISITE )(Citation: ClearkSky Fox Kitten February 2020)(Citation: CrowdStrike PIONEER KITTEN August 2020)
- [25]Parisite
(Citation: Dragos PARISITE )(Citation: ClearkSky Fox Kitten February 2020)(Citation: CrowdStrike PIONEER KITTEN August 2020)
- [26]Parisite
(Citation: Dragos PARISITE )(Citation: ClearkSky Fox Kitten February 2020)(Citation: CrowdStrike PIONEER KITTEN August 2020)
- [27]Pioneer Kitten
(Citation: CrowdStrike PIONEER KITTEN August 2020)(Citation: CISA AA20-259A Iran-Based Actor September 2020)
- [28]Pioneer Kitten
(Citation: CrowdStrike PIONEER KITTEN August 2020)(Citation: CISA AA20-259A Iran-Based Actor September 2020)
- [29]Pioneer Kitten
(Citation: CrowdStrike PIONEER KITTEN August 2020)(Citation: CISA AA20-259A Iran-Based Actor September 2020)
- [30]RUBIDIUM
(Citation: Microsoft Threat Actor Naming July 2023)
- [31]RUBIDIUM
(Citation: Microsoft Threat Actor Naming July 2023)
- [32]RUBIDIUM
(Citation: Microsoft Threat Actor Naming July 2023)
- [33]UNC757
(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: CrowdStrike PIONEER KITTEN August 2020)
- [34]UNC757
(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: CrowdStrike PIONEER KITTEN August 2020)
- [35]UNC757
(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: CrowdStrike PIONEER KITTEN August 2020)
- [36]mitre-attackG0117Open source URL
- [37]mitre-attackG0117Open source URL
- [38]mitre-attackG0117Open source URL
- [39]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [40]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [41]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [42]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [43]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [44]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [45]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [46]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [47]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [48]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [49]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [50]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [51]ClearkSky Fox Kitten February 2020
ClearSky. (2020, February 16). Fox Kitten – Widespread Iranian Espionage-Offensive Campaign. Retrieved December 21, 2020.
Open source URL - [52]ClearkSky Fox Kitten February 2020
ClearSky. (2020, February 16). Fox Kitten – Widespread Iranian Espionage-Offensive Campaign. Retrieved December 21, 2020.
Open source URL - [53]CrowdStrike PIONEER KITTEN August 2020
Orleans, A. (2020, August 31). Who Is PIONEER KITTEN?. Retrieved December 21, 2020.
Open source URL - [54]CrowdStrike PIONEER KITTEN August 2020
Orleans, A. (2020, August 31). Who Is PIONEER KITTEN?. Retrieved December 21, 2020.
Open source URL - [55]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [56]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [57]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [58]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [59]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [60]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [61]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [62]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [63]Check Point Pay2Key November 2020
Check Point. (2020, November 6). Ransomware Alert: Pay2Key. Retrieved January 4, 2021.
Open source URL - [64]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [65]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [66]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [67]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [68]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [69]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [70]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [71]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [72]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [73]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [74]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [75]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [76]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [77]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [78]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [79]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [80]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [81]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [82]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [83]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [84]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [85]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [86]ClearkSky Fox Kitten February 2020
ClearSky. (2020, February 16). Fox Kitten – Widespread Iranian Espionage-Offensive Campaign. Retrieved December 21, 2020.
Open source URL - [87]ClearkSky Fox Kitten February 2020
ClearSky. (2020, February 16). Fox Kitten – Widespread Iranian Espionage-Offensive Campaign. Retrieved December 21, 2020.
Open source URL - [88]CrowdStrike PIONEER KITTEN August 2020
Orleans, A. (2020, August 31). Who Is PIONEER KITTEN?. Retrieved December 21, 2020.
Open source URL - [89]CrowdStrike PIONEER KITTEN August 2020
Orleans, A. (2020, August 31). Who Is PIONEER KITTEN?. Retrieved December 21, 2020.
Open source URL - [90]Dragos PARISITE
Dragos. (n.d.). PARISITE. Retrieved December 21, 2020.
Open source URL - [91]Dragos PARISITE
Dragos. (n.d.). PARISITE. Retrieved December 21, 2020.
Open source URL - [92]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [93]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [94]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [95]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [96]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [97]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [98]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [99]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [100]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [101]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [102]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [103]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [104]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [105]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [106]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [107]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [108]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [109]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [110]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [111]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [112]Check Point Pay2Key November 2020
Check Point. (2020, November 6). Ransomware Alert: Pay2Key. Retrieved January 4, 2021.
Open source URL - [113]Check Point Pay2Key November 2020
Check Point. (2020, November 6). Ransomware Alert: Pay2Key. Retrieved January 4, 2021.
Open source URL - [114]ClearkSky Fox Kitten February 2020
ClearSky. (2020, February 16). Fox Kitten – Widespread Iranian Espionage-Offensive Campaign. Retrieved December 21, 2020.
Open source URL - [115]ClearkSky Fox Kitten February 2020
ClearSky. (2020, February 16). Fox Kitten – Widespread Iranian Espionage-Offensive Campaign. Retrieved December 21, 2020.
Open source URL - [116]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [117]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [118]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [119]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [120]Check Point Pay2Key November 2020
Check Point. (2020, November 6). Ransomware Alert: Pay2Key. Retrieved January 4, 2021.
Open source URL - [121]Check Point Pay2Key November 2020
Check Point. (2020, November 6). Ransomware Alert: Pay2Key. Retrieved January 4, 2021.
Open source URL - [122]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [123]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [124]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [125]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [126]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [127]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [128]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [129]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [130]CrowdStrike PIONEER KITTEN August 2020
Orleans, A. (2020, August 31). Who Is PIONEER KITTEN?. Retrieved December 21, 2020.
Open source URL - [131]CrowdStrike PIONEER KITTEN August 2020
Orleans, A. (2020, August 31). Who Is PIONEER KITTEN?. Retrieved December 21, 2020.
Open source URL - [132]CrowdStrike PIONEER KITTEN August 2020
Orleans, A. (2020, August 31). Who Is PIONEER KITTEN?. Retrieved December 21, 2020.
Open source URL - [133]CrowdStrike PIONEER KITTEN August 2020
Orleans, A. (2020, August 31). Who Is PIONEER KITTEN?. Retrieved December 21, 2020.
Open source URL - [134]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [135]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [136]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [137]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [138]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [139]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [140]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [141]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [142]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [143]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [144]Check Point Pay2Key November 2020
Check Point. (2020, November 6). Ransomware Alert: Pay2Key. Retrieved January 4, 2021.
Open source URL - [145]Check Point Pay2Key November 2020
Check Point. (2020, November 6). Ransomware Alert: Pay2Key. Retrieved January 4, 2021.
Open source URL - [146]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [147]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [148]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [149]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [150]ClearSky Pay2Kitten December 2020
ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
Open source URL - [151]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [152]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [153]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.