Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.1234
- ClearkSky Fox Kitten February 2020
- CrowdStrike PIONEER KITTEN August 2020
- Dragos PARISITE
- ClearSky Pay2Kitten December 2020
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1105 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1530 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1210 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.010 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.005 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1217 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.005 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.002 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.005 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.003 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.004 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.004 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1012 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1572 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1039 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1546.008 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2020 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.003 | NTDS | — |
| T1005 | Data from Local System | — |
| T1012 | Query Registry | — |
| T1018 | Remote System Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1021.002 | SMB/Windows Admin Shares | — |
| T1021.004 | SSH | — |
| T1021.005 | VNC | — |
| T1027.010 | Command Obfuscation | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1036.004 | Masquerade Task or Service | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1039 | Data from Network Shared Drive | — |
| T1046 | Network Service Discovery | — |
| T1053.005 | Scheduled Task | — |
| T1059 | Command and Scripting Interpreter | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1078 | Valid Accounts | — |
| T1083 | File and Directory Discovery | — |
| T1087.001 | Local Account | — |
| T1087.002 | Domain Account | — |
| T1090 | Proxy | — |
| T1102 | Web Service | — |
| T1105 | Ingress Tool Transfer | — |
| T1110 | Brute Force | — |
| T1136.001 | Local Account | — |
| T1190 | Exploit Public-Facing Application | — |
| T1210 | Exploitation of Remote Services | — |
| T1213.005 | Messaging Applications | — |
| T1217 | Browser Information Discovery | — |
| T1505.003 | Web Shell | — |
| T1530 | Data from Cloud Storage | — |
| T1546.008 | Accessibility Features | — |
| T1552.001 | Credentials In Files | — |
| T1555.005 | Password Managers | — |
| T1560.001 | Archive via Utility | — |
| T1572 | Protocol Tunneling | — |
| T1585 | Establish Accounts | — |
| T1585.001 | Social Media Accounts | — |
Aliases
Fox Kitten · Lemon Sandstorm · Parisite · Pioneer Kitten · RUBIDIUM · UNC757
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.