Fox Kitten

Origin🇮🇷 Irã

Techniques (MITRE ATT&CK)41

SourceMITRE ATT&CK

Also known as:Lemon SandstormPARISITEPIONEER KITTENParisitePioneer KittenRUBIDIUMUNC757

About the group

Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity59

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 41

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Establish Accounts Social Media Accounts

Initial access

Exploit Public-Facing Application

Execution

Scheduled Task Command and Scripting Interpreter PowerShell Windows Command Shell

Persistence

Local Account Web Shell

Privilege escalation

Accessibility Features

Credential access

LSASS Memory NTDS Brute Force Credentials In Files Password Managers

Discovery

Query Registry Remote System Discovery Network Service Discovery File and Directory Discovery Local Account Domain Account Browser Information Discovery

Lateral movement

Remote Desktop Protocol SMB/Windows Admin Shares SSH VNC Exploitation of Remote Services

Collection

Data from Local System Data from Network Shared Drive Messaging Applications Data from Cloud Storage Archive via Utility

Command and control

Proxy Web Service Ingress Tool Transfer Protocol Tunneling

stealth

Command Obfuscation Encrypted/Encoded File Masquerade Task or Service Match Legitimate Resource Name or Location Valid Accounts

Exploited vulnerabilities 4

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2014-7169CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2016-6662EPSS 68% MITRE ATT&CK

CVE-2017-0176EPSS 46% MITRE ATT&CK

CVE-2019-3610MEDIUMEPSS 0% MITRE ATT&CK

Known infrastructure 8

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

ip:port45.76.165.219:443SystemBCthreatfox

ip:port45.86.230.112:4001SystemBCthreatfox

domainpaladin5.comSystemBCthreatfox

domainanzo11rikasha22b.pwSystemBCthreatfox

domainkall4234ribk3assa.pwSystemBCthreatfox

ip:port94.232.46.202:4321SystemBCthreatfox

sha256_hash1eb027a9844495e9a3c64bc0c7ea645058933a9b18cc98ff3f42a7b1a9142753SystemBCmalwarebazaar

ip:port34.171.171.32:4001SystemBCthreatfox

References

Fox Kitten uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →