Início / Grupos de ameaça / Fox Kitten

Fox Kitten G0117

🔔 Criar alerta

Também conhecido como: UNC757, Parisite, Pioneer Kitten, RUBIDIUM, Lemon Sandstorm

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

0

CVEs associadas

47

Técnicas

5

Malwares e ferramentas

Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.

Operações de ransomware ligadas a este grupo ransomware.live

pay2key via Pay2Key

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

O ATT&CK não cita CVEs para este grupo.

Técnicas por tática

Desenvolvimento de recursos

T1585 Establish Accounts T1585.001 Social Media Accounts

Acesso inicial

T1078 Valid Accounts T1190 Exploit Public-Facing Application

Execução

T1053.005 Scheduled Task T1059 Command and Scripting Interpreter T1059.001 PowerShell T1059.003 Windows Command Shell

Persistência

T1053.005 Scheduled Task T1078 Valid Accounts T1136.001 Local Account T1505.003 Web Shell T1546.008 Accessibility Features

Escalada de privilégios

T1053.005 Scheduled Task T1078 Valid Accounts T1546.008 Accessibility Features

Furtividade

T1027.010 Command Obfuscation T1027.013 Encrypted/Encoded File T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1078 Valid Accounts

Acesso a credenciais

T1003.001 LSASS Memory T1003.003 NTDS T1110 Brute Force T1552.001 Credentials In Files T1555.005 Password Managers

Descoberta

T1012 Query Registry T1018 Remote System Discovery T1046 Network Service Discovery T1083 File and Directory Discovery T1087.001 Local Account T1087.002 Domain Account T1217 Browser Information Discovery

Movimento lateral

T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1021.004 SSH T1021.005 VNC T1210 Exploitation of Remote Services

Coleta

T1005 Data from Local System T1039 Data from Network Shared Drive T1213.005 Messaging Applications T1530 Data from Cloud Storage T1560.001 Archive via Utility

Comando e controle

T1090 Proxy T1102 Web Service T1105 Ingress Tool Transfer T1572 Protocol Tunneling

Malwares e ferramentas

China ChopperMalwareS0020
Pay2KeyMalwareS0556
SystemBCMalwareS9001
ngrokFerramentaS0508
PsExecFerramentaS0029

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.