Threat intelligence / Group

Fox Kitten

[Fox Kitten](https://attack.mitre.org/groups/G0117) is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. [Fox Kitten](https://attack.mitre.org/groups/G0117) has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.(Citation: ClearkSky Fox Kitten February 2020)(Citation: CrowdStrike PIONEER KITTEN August 2020)(Citation: Dragos PARISITE )(Citation: ClearSky Pay2Kitten December 2020)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Fox Kitten](https://attack.mitre.org/groups/G0117) is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. [Fox Kitten](https://attack.mitre.org/groups/G0117) has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.(Citation: ClearkSky Fox Kitten February 2020)(Citation: CrowdStrike PIONEER KITTEN August 2020)(Citation: Dragos PARISITE )(Citation: ClearSky Pay2Kitten December 2020)

46 recorded

Relationships

uses

to Accessibility Features

Technique

uses

to Archive via Utility

Technique

uses

to Browser Information Discovery

Technique

uses

Technique

uses

to China Chopper

Malware

uses

to Command and Scripting Interpreter

Technique

uses

to Command Obfuscation

Technique

uses

to Credentials In Files

Technique

uses

to Data from Cloud Storage

Technique

uses

to Data from Local System

Technique

uses

to Data from Network Shared Drive

Technique

uses

to Domain Account

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Establish Accounts

Technique

uses

to Exploitation of Remote Services

Technique

uses

to Exploit Public-Facing Application

Technique

uses

to File and Directory Discovery

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Local Account

Technique

uses

to Local Account

Technique

uses

to LSASS Memory

Technique

uses

to Masquerade Task or Service

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Messaging Applications

Technique

uses

to Network Service Discovery

Technique

uses

Tool

uses

Technique

uses

to Password Managers

Technique

uses

Malware

uses

Technique

uses

to Protocol Tunneling

Technique

uses

Technique

uses

Tool

uses

to Query Registry

Technique

uses

to Remote Desktop Protocol

Technique

uses

to Remote System Discovery

Technique

uses

to Scheduled Task

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

to Social Media Accounts

Technique

uses

to SSH

Technique

uses

Malware

uses

to Valid Accounts

Technique

uses

to VNC

Technique

uses

Technique

uses

Technique

uses

to Windows Command Shell

Technique

12 external

References

mitre-attack

G0117

UNC757

—

Pioneer Kitten

—

Parisite

—

RUBIDIUM

—

Lemon Sandstorm

—

CISA AA20-259A Iran-Based Actor September 2020

https://us-cert.cisa.gov/ncas/alerts/aa20-259a

ClearSky Pay2Kitten December 2020

https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf

ClearkSky Fox Kitten February 2020

https://www.clearskysec.com/fox-kitten/

Dragos PARISITE

https://www.dragos.com/threat/parisite/

Microsoft Threat Actor Naming July 2023

https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide

CrowdStrike PIONEER KITTEN August 2020

https://www.crowdstrike.com/blog/who-is-pioneer-kitten/