H3XAOperational intelligence
Live analytical pictureEvidence before assessment
TypeGroup
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Ajax Security Team](https://attack.mitre.org/groups/G0130) is a group that has been active since at least 2010 and believed to be operating out of Iran. By 2014 [Ajax Security Team](https://attack.mitre.org/groups/G0130) transitioned from website defacement operations to malware-based cyber espionage campaigns targeting the US defense industrial base and Iranian users of anti-censorship technologies.(Citation: FireEye Operation Saffron Rose 2013)

8 recorded

Relationships

usesTool
usesTechnique
usesTechnique
usesTechnique
usesTechnique
usesTool
11 external

References

mitre-attack
G0130
open
Flying Kitten
—
AjaxTM
—
Operation Saffron Rose
—
Rocket Kitten
—
Operation Woolen-Goldfish
—
TrendMicro Operation Woolen Goldfish March 2015
https://documents.trendmicro.com/assets/wp/wp-operation-woolen-goldfish.pdf
open
Check Point Rocket Kitten
https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf
open
CrowdStrike Flying Kitten
https://www.crowdstrike.com/blog/cat-scratch-fever-crowdstrike-tracks-newly-reported-iranian-actor-flying-kitten/
open
IranThreats Kittens Dec 2017
https://iranthreats.github.io/resources/attribution-flying-rocket-kitten/
open
FireEye Operation Saffron Rose 2013
https://www.mandiant.com/sites/default/files/2021-09/rpt-operation-saffron-rose.pdf
open