Fox Kitten - G0117

Created: 2020-12-21T21:49:47.307Z

Modified: 2023-03-22T03:53:37.888Z

Contributors:

Aliases

Fox Kitten,UNC757,Parisite,Pioneer Kitten

Description

Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.(Citation: ClearkSky Fox Kitten February 2020)(Citation: CrowdStrike PIONEER KITTEN August 2020)(Citation: Dragos PARISITE )(Citation: ClearSky Pay2Kitten December 2020)

Techniques Used

Fox Kitten has base64 encoded scripts to avoid detection.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102|Web Service|

Fox Kitten has used Amazon Web Services to host C2.(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|PRE|T1585.001|Social Media Accounts|

Fox Kitten has used a Twitter account to communicate with ransomware victims.(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|PRE|T1585|Establish Accounts|

Fox Kitten has created KeyBase accounts to communicate with ransomware victims.(Citation: ClearSky Pay2Kitten December 2020)(Citation: Check Point Pay2Key November 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090|Proxy|