RedKitten is an AI-accelerated campaign targeting Iranian interests using Telegram C2 and cloud services.
Analyst brief
RedKitten is a campaign targeting Iranian interests, particularly NGOs and individuals documenting human rights abuses, first observed in January 2026. The activity exhibits TTPs associated with Iranian state-sponsored actors and is characterized as an AI-accelerated campaign. Key TTPs include leveraging GitHub and Google Drive for configuration and payload retrieval, and Telegram for C2. Defenders should monitor for anomalous network requests to these services and signs of Farsi-language spear-phishing.
RedKitten
unknown
RedKitten is a campaign targeting Iranian interests, particularly NGOs and individuals documenting human rights abuses, first observed in January 2026. The malware utilizes GitHub and Google Drive for configuration and payload retrieval, while employing Telegram for command and control. Although precise attribution is challenging, the activity exhibits TTPs associated with Iranian state-sponsored actors and linguistic indicators suggest a Farsi-speaking threat actor. RedKitten is characterized as an AI-accelerated campaign exploiting the humanitarian crisis surrounding Iran’s Dey 1404 protests.