H3XA — Operational Evidence

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Ferocious Kitten](https://attack.mitre.org/groups/G0137) is a threat group that has primarily targeted Persian-speaking individuals in Iran since at least 2015.(Citation: Kaspersky Ferocious Kitten Jun 2021)

8 recorded

Relationships

uses

to BITSAdmin

Tool

uses

to Domains

Technique

uses

to Malicious File

Technique

uses

to MarkiRAT

Malware

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Right-to-Left Override

Technique

uses

to Spearphishing Attachment

Technique

uses

to Tool

Technique

2 external

References

mitre-attack

G0137

open

Kaspersky Ferocious Kitten Jun 2021

https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/

open