FORENSIA

THREAT_ACTOR · G0117

Fox Kitten

Also known as: Fox Kitten, UNC757, Parisite, Pioneer Kitten, RUBIDIUM, Lemon Sandstorm

Profile

Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.

MITRE ATT&CK ↗

Techniques

41 ATT&CK techniques attributed to this actor.

T1003.001 LSASS MemoryT1003.003 NTDST1005 Data from Local SystemT1012 Query RegistryT1018 Remote System DiscoveryT1021.001 Remote Desktop ProtocolT1021.002 SMB/Windows Admin SharesT1021.004 SSHT1021.005 VNCT1027.010 Command ObfuscationT1027.013 Encrypted/Encoded FileT1036.004 Masquerade Task or ServiceT1036.005 Match Legitimate Resource Name or LocationT1039 Data from Network Shared DriveT1046 Network Service DiscoveryT1053.005 Scheduled TaskT1059 Command and Scripting InterpreterT1059.001 PowerShellT1059.003 Windows Command ShellT1078 Valid AccountsT1083 File and Directory DiscoveryT1087.001 Local AccountT1087.002 Domain AccountT1090 ProxyT1102 Web ServiceT1105 Ingress Tool TransferT1110 Brute ForceT1136.001 Local AccountT1190 Exploit Public-Facing ApplicationT1210 Exploitation of Remote ServicesT1213.005 Messaging ApplicationsT1217 Browser Information DiscoveryT1505.003 Web ShellT1530 Data from Cloud StorageT1546.008 Accessibility FeaturesT1552.001 Credentials In FilesT1555.005 Password ManagersT1560.001 Archive via UtilityT1572 Protocol TunnelingT1585 Establish AccountsT1585.001 Social Media Accounts

Software

5 malware/tools attributed to this actor.

China ChopperPsExecngrokPay2KeySystemBC

Related corpus activity

9,917 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Fox Kitten.

IndicatorTypeFamilySevSrc
cve-2023-44976cveransomware852
cve-2026-1969cve—851
cve-2025-68670cve—852
cve-2026-3102cve—853
cve-2025-34117cve—851
cve-2021-29441cve—851
cve-2026-22584cve—852
cve-2025-11837cve—852
cve-2025-34054cve—854
cve-2014-2321cve—851
cve-2020-17456cve—851
cve-2025-2492cve—852
cve-2017-18377cve—851
cve-2021-25646cve—851
cve-2025-66478cve—852
cve-2025-0921cve—852
cve-2021-27076cve—851
cve-2013-3307cve—852
cve-2016-5681cve—852
cve-2016-15047cve—854
cve-2024-1781cve—851
cve-2018-8007cve—851
cve-2022-47945cve—851
cve-2021-4045cve—851
cve-2020-22653cve—852
cve-2020-22658cve—852
cve-2025-23304cve—852
cve-2026-4368cveransomware851
cve-2013-7471cve—851
cve-2026-0740cve—851

Showing the top 30 by severity of 9,917.