File · DEV-0270 · Unknown · assessed origin Iran · misp-galaxy · refreshed 2026-10-06
DEV-0270
- Nemesis Kitten
- Storm-0270
sigil · no ATT&CK coverage stated
What changed
ledger · newest first- —todaynew CVE1 new CVE: CVE-2018-13379
Analyst brief
misp-galaxyMicrosoft threat intelligence teams have been tracking multiple ransomware campaigns and have tied these attacks to DEV-0270, also known as Nemesis Kitten, a sub-group of Iranian actor PHOSPHORUS. Microsoft assesses with moderate confidence that DEV-0270 conducts malicious network operations, including widespread vulnerability scanning, on behalf of the government of Iran.
CVEs DEV-0270 is cited as exploiting
none on KEV- CVE-2018-133792026-10-17
“In many of the observed DEV-0270 instances, the actor gained access by exploiting known vulnerabilities in Exchange or Fortinet (CVE-2018-13379).”
cited as exploiting · source: microsoft.com ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Take it with you
keyless · no signupReferences
1 sourceTrack DEV-0270 on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.