Fox Kitten has used the open source reverse proxy tools including FRPC and Go Proxy to establish connections from C2 to local servers.(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: ClearSky Pay2Kitten December 2020)(Citation: Check Point Pay2Key November 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1136.001|Local Account|

Fox Kitten has created a local user account with administrator privileges.(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1110|Brute Force|

Fox Kitten has brute forced RDP credentials.(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network,Office 365,Azure AD,IaaS,Google Workspace|T1059|Command and Scripting Interpreter|

Fox Kitten has used a Perl reverse shell to communicate with C2.(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

Fox Kitten has used 7-Zip to archive data.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Fox Kitten has downloaded additional tools including

PsExec directly to endpoints.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|IaaS,SaaS|T1530|Data from Cloud Storage|

Fox Kitten has obtained files from the victim's cloud storage instances.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|