CVE Intelligence
Home / Threat actors / Ajax Security Team

Ajax Security Team G0130

🔔 Create alert

Also known as: Operation Woolen-Goldfish, AjaxTM, Rocket Kitten, Flying Kitten, Operation Saffron Rose

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0
associated CVEs
7
Techniques
2
Malware and tools

Ajax Security Team is a group that has been active since at least 2010 and believed to be operating out of Iran. By 2014 Ajax Security Team transitioned from website defacement operations to malware-based cyber espionage campaigns targeting the US defense industrial base and Iranian users of anti-censorship technologies.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Initial Access
T1566.001 Spearphishing AttachmentT1566.003 Spearphishing via Service
Execution
T1204.002 Malicious File
Credential Access
T1056.001 KeyloggingT1555.003 Credentials from Web Browsers
Collection
T1056.001 Keylogging
Command and Control
T1105 Ingress Tool Transfer

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.