Fox Kitten· Iran

Fox Kitten is an Iran-linked cyber espionage group targeting sensitive entities.

Analyst brief

Fox Kitten (PIONEER KITTEN, Lemon Sandstorm) is an Iran-nexus cyber espionage actor active since at least 2017, focusing on entities with sensitive intelligence value, including ICS-related targets. Their key TTPs include exploiting public-facing application vulnerabilities for initial access, deploying tools like China Chopper, SystemBC, ngrok, and PsExec, and using techniques such as brute force, VNC for lateral movement, and command obfuscation for stealth. Defenders should prioritize patching VPN and public-facing systems, monitoring for unauthorized account creation, and detecting proxy-based C2 channels.

Fox Kitten

PIONEER KITTENPARISITEUNC757

unknown

PIONEER KITTEN is an Iran-based adversary that has been active since at least 2017 and has a suspected nexus to the Iranian government. This adversary appears to be primarily focused on gaining and maintaining access to entities possessing sensitive information of likely intelligence interest to the Iranian government. According to DRAGOS, they also targeted ICS-related entities using known VPN vulnerabilities. They are widely known to use open source penetration testing tools for reconnaissance and to establish encrypted communications.

origin (suspected)

Iran

techniques · ATT&CK

Establish Accounts Exploit Public-Facing Application Command and Scripting Interpreter Windows Command Shell Local Account Accessibility Features Command Obfuscation Brute Force+8

malware

China Chopper Pay2Key SystemBC ngrok PsExec

source: misp-galaxy + mitre-attackG0117 15 refs →

Kill-chain playbook11

01
resource-development
T1585
Monitor for new account creation on public platforms and investigate unusual account activity.
02
initial-access
T1190
Monitor network traffic and logs for exploit attempts against public-facing applications.
03
execution
T1059 T1059.003
Monitor for command-line interpreter use, especially Windows Command Shell, and investigate suspicious scripting.
04
persistence
T1136.001
Monitor for local account creation and modification activity, and verify if new accounts are legitimate.
05
privilege-escalation
T1546.008
Monitor for Accessibility Features modification and investigate suspicious changes.
06
stealth
T1027.010
Analyze command-line logs for suspicious command syntax or use of encoding/encryption.
07
credential-access
T1110 T1552.001
Monitor for brute force authentication attempts and credentials stored in files.
08
discovery
T1018 T1217
Monitor for remote system discovery and browser information gathering activity, and investigate suspicious queries.
09
lateral-movement
T1021.005
Monitor for VNC connection attempts and investigate suspicious remote access activity.
10
collection
T1530 T1560.001
Monitor for data collection from cloud storage and use of archiving utilities.
11
command-and-control
T1090 T1105
Monitor for suspicious proxy activity and tool transfer, and investigate unusual network traffic.

FAQ2

What tools does Fox Kitten use to maintain persistence on target systems?

Fox Kitten uses tools like China Chopper, SystemBC, ngrok, and PsExec for persistence.

What is Fox Kitten's method for initial access?

The actor exploits vulnerabilities in public-facing applications for initial access.

Fox Kitten· Iran

Analyst brief

Fox Kitten

Kill-chain playbook11

resource-development

initial-access

execution

persistence

privilege-escalation

stealth

credential-access

discovery

lateral-movement

collection

command-and-control

FAQ2

See also6

Fox Kitten· Iran

Analyst brief

Fox Kitten

Kill-chain playbook11

resource-development

initial-access

execution

persistence

privilege-escalation

stealth

credential-access

discovery

lateral-movement

collection

command-and-control

FAQ2

See also6