Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Flying Kitten · Nation-state · assessed origin Iran · misp-galaxy + mitre-attack · refreshed 2026-10-06

Flying Kitten

  • SaffronRose
  • Saffron Rose
  • AjaxSecurityTeam
  • Ajax Security Team
  • Group 26
  • Sayad
  • Operation Woolen-Goldfish
  • AjaxTM

state sponsor · Iran (Islamic Republic of)MITRE G0130 ↗

Flying Kitten — ATT&CK roseFK

attack rose · 6 techniques across 5 tactics

Analyst brief

misp-galaxy + mitre-attack

Activity: defense and aerospace sectors, also interested in targeting entities in the oil/gas industry.

Observed targets (as stated by the sources)

1 countries · 6 sectors
United StatesAssessed origin: Iran

assessed origin · Iranobserved targets · 1

countries · 1

  • United States

sectors · 6

  • Military
  • Civil society
  • Aerospace
  • Defense
  • Gas
  • Oil

also stated: Iranian internet activists

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

6 techniques · 5 of 15 tactics

  1. Initial access

    2 techniques

  2. Execution

    1 technique

  3. Credential access

    1 technique

  4. Collection

    1 technique

  5. Command and control

    1 technique

select a technique

Arsenal

2 tools
Tools
Tools · 2ATT&CK
sqlmapS0225 ↗
HavijS0224 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2015Operation Woolen-Goldfish When Kittens Go PhishingTrend Micro ↗
  2. 2015Rocket Kitten: A Campaign With 9 LivesCheckpoint ↗
  3. 2014Operation Saffron RoseFireEye ↗
  4. 2014Cat Scratch Fever: Crowdstrike Tracks Newly Reported Iranian Actor As Flying KittenCrowdstrike ↗
  5. 2014Sayad (Flying Kitten) Infostealer: Is This The Work Of The Iranian Ajax Security Team?Vinsula ↗

Take it with you

keyless · no signup

References

8 sources
  1. 1.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs…
  2. 2.crowdstrike.com/blog/cat-scratch-fever-crowdstrike-tracks-newly-report…
  3. 3.cfr.org/interactive/cyber-operations/saffron-rose
  4. 4.attack.mitre.org/groups/G0130
  5. 5.documents.trendmicro.com/assets/wp/wp-operation-woolen-goldfish.pdf
  6. 6.blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf
  7. 7.iranthreats.github.io/resources/attribution-flying-rocket-kitten
  8. 8.mandiant.com/sites/default/files/2021-09/rpt-operation-saffron-rose…

Track Flying Kitten on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.