Fox Kitten

Threat actor

Attributed to Iran by MITRE ATT&CK (source). An attribution, not a proven fact.

Names and who uses them

Fox KittenOur name
UNC757CISA
Pioneer KittenCrowdStrike
ParisiteDragos
Lemon SandstormMicrosoft
RUBIDIUMMicrosoft

Targets

Sectors: Government, Defence, Energy, Healthcare, Manufacturing

Source: MITRE ATT&CK

Known techniques

T1003.001LSASS Memory
T1003.003NTDS
T1005Data from Local System
T1012Query Registry
T1018Remote System Discovery
T1021.001Remote Desktop Protocol
T1021.002SMB/Windows Admin Shares
T1021.004SSH
T1021.005VNC
T1027.010Command Obfuscation
T1027.013Encrypted/Encoded File
T1036.004Masquerade Task or Service
T1036.005Match Legitimate Resource Name or Location
T1039Data from Network Shared Drive
T1046Network Service Discovery
T1053.005Scheduled Task
T1059Command and Scripting Interpreter
T1059.001PowerShell
T1059.003Windows Command Shell
T1078Valid Accounts
T1083File and Directory Discovery
T1087.001Local Account
T1087.002Domain Account
T1090Proxy
T1102Web Service
T1105Ingress Tool Transfer
T1110Brute Force
T1136.001Local Account
T1190Exploit Public-Facing Application
T1210Exploitation of Remote Services
T1213.005Messaging Applications
T1217Browser Information Discovery
T1505.003Web Shell
T1530Data from Cloud Storage
T1546.008Accessibility Features
T1552.001Credentials In Files
T1555.005Password Managers
T1560.001Archive via Utility
T1572Protocol Tunneling
T1585Establish Accounts

Source: MITRE ATT&CK

Malware and tools used

China Chopper ngrok Pay2Key PsExec SystemBC

Source: MITRE ATT&CK

Recent news

No stories yet.