DEV-0270 (Nemesis Kitten) is an Iran-linked subgroup of PHOSPHORUS conducting ransomware operations.
DEV-0270 (Nemesis Kitten) is a sub-group of the Iranian state-linked actor PHOSPHORUS, primarily involved in ransomware campaigns. The actor gains initial access through widespread vulnerability scanning and exploitation. Defenders should prioritize patching internet-facing systems and implement robust backup and recovery procedures to mitigate ransomware impact.
Microsoft threat intelligence teams have been tracking multiple ransomware campaigns and have tied these attacks to DEV-0270, also known as Nemesis Kitten, a sub-group of Iranian actor PHOSPHORUS. Microsoft assesses with moderate confidence that DEV-0270 conducts malicious network operations, including widespread vulnerability scanning, on behalf of the government of Iran.
DEV-0270 is a sub-group of the Iranian state-linked actor PHOSPHORUS.
DEV-0270 gains initial access through widespread vulnerability scanning and exploitation.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.