Home / Threat actors / Fox Kitten

Fox Kitten G0117

🔔 Create alert

Also known as: UNC757, Parisite, Pioneer Kitten, RUBIDIUM, Lemon Sandstorm

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0

associated CVEs

47

Techniques

5

Malware and tools

Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.

Ransomware operations linked to this group ransomware.live

pay2key via Pay2Key

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Resource Development

T1585 Establish Accounts T1585.001 Social Media Accounts

Initial Access

T1078 Valid Accounts T1190 Exploit Public-Facing Application

Execution

T1053.005 Scheduled Task T1059 Command and Scripting Interpreter T1059.001 PowerShell T1059.003 Windows Command Shell

Persistence

T1053.005 Scheduled Task T1078 Valid Accounts T1136.001 Local Account T1505.003 Web Shell T1546.008 Accessibility Features

Privilege Escalation

T1053.005 Scheduled Task T1078 Valid Accounts T1546.008 Accessibility Features

Stealth

T1027.010 Command Obfuscation T1027.013 Encrypted/Encoded File T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1078 Valid Accounts

Credential Access

T1003.001 LSASS Memory T1003.003 NTDS T1110 Brute Force T1552.001 Credentials In Files T1555.005 Password Managers

Discovery

T1012 Query Registry T1018 Remote System Discovery T1046 Network Service Discovery T1083 File and Directory Discovery T1087.001 Local Account T1087.002 Domain Account T1217 Browser Information Discovery

Lateral Movement

T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1021.004 SSH T1021.005 VNC T1210 Exploitation of Remote Services

Collection

T1005 Data from Local System T1039 Data from Network Shared Drive T1213.005 Messaging Applications T1530 Data from Cloud Storage T1560.001 Archive via Utility

Command and Control

T1090 Proxy T1102 Web Service T1105 Ingress Tool Transfer T1572 Protocol Tunneling

Malware and tools

China ChopperMalwareS0020
Pay2KeyMalwareS0556
SystemBCMalwareS9001
ngrokToolS0508
PsExecToolS0029

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.