Trusted Design

Fox Kitten

アクターID: G0117

· MITRE Pageへのリンク

脅威アクターの詳細

Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.(Citation: ClearkSky Fox Kitten February 2020)(Citation: CrowdStrike PIONEER KITTEN August 2020)(Citation: Dragos PARISITE )(Citation: ClearSky Pay2Kitten December 2020)

脅威アクターの別名・別称

Fox Kitten
UNC757
Parisite
Pioneer Kitten
RUBIDIUM
Lemon Sandstorm

利用した攻撃手法

• T1053.005 - Scheduled Task
• T1560.001 - Archive via Utility
• T1021.005 - VNC
• T1491.002 - External Defacement
• T1218.013 - Mavinject
• T1587.001 - Malware
• T1592.001 - Hardware
• T1165 - Startup Items
• T1559.001 - Component Object Model
• T1553.001 - Gatekeeper Bypass
• T1584.003 - Virtual Private Server
• T1140 - Deobfuscate/Decode Files or Information
• T1032 - Standard Cryptographic Protocol
• T1062 - Hypervisor
• T1555.003 - Credentials from Web Browsers
• T1491 - Defacement
• T1583.004 - Server
• T1546.005 - Trap
• T1177 - LSASS Driver
• T1045 - Software Packing
• T1055.013 - Process Doppelgänging
• T1219.001 - IDE Tunneling
• T1588.001 - Malware
• T1612 - Build Image on Host
• T1051 - Shared Webroot
• T1497.002 - User Activity Based Checks
• T1059.001 - PowerShell
• T1097 - Pass the Ticket
• T1542.004 - ROMMONkit
• T1157 - Dylib Hijacking
• T1565 - Data Manipulation
• T1570 - Lateral Tool Transfer
• T1656 - Impersonation
• T1591.004 - Identify Roles
• T1601.001 - Patch System Image
• T1134 - Access Token Manipulation
• T1209 - Time Providers
• T1547.013 - XDG Autostart Entries
• T1622 - Debugger Evasion
• T1548.006 - TCC Manipulation
• T1588.005 - Exploits

関連するCVE (攻撃手法に関連)

• CVE-2015-4495 (T1157)
• CVE-2015-5749 (T1051)
• CVE-2016-1898 (T1051)
• CVE-2016-1897 (T1051)
• CVE-2015-7261 (T1051)
• CVE-2015-6036 (T1051)
• CVE-2015-7262 (T1157)
• CVE-2015-0932 (T1051)
• CVE-2010-3081 (T1209)
• CVE-2017-16929 (T1051)
• CVE-2025-31125 (T1157)
• CVE-2025-68645 (T1209)
• CVE-2015-7755 (T1177)
• CVE-2015-8286 (T1177)
• CVE-2015-8287 (T1177)
• CVE-2023-1389 (T1134)
• CVE-2016-2343 (T1612)
• CVE-2016-6532 (T1097)
• CVE-2014-4114 (T1601.001)
• CVE-2015-5119 (T1097)
• CVE-2015-5122 (T1134)
• CVE-2012-1856 (T1548.006)
• CVE-2015-2545 (T1051)
• CVE-2015-7645 (T1051)
• CVE-2017-0199 (T1622)
• CVE-2015-3043 (T1134)
• CVE-2015-3090 (T1219.001)
• CVE-2015-3113 (T1097)
• CVE-2015-2590 (T1059.001)
• CVE-2015-2424 (T1219.001)
• CVE-2015-0097 (T1219.001)
• CVE-2012-0158 (T1548.006)
• CVE-2014-1761 (T1177)
• CVE-2015-2502 (T1059.001)
• CVE-2014-6271 (T1209)
• CVE-2013-2094 (T1157)
• CVE-2016-1010 (T1219.001)
• CVE-2016-1019 (T1157)
• CVE-2016-0984 (T1219.001)
• CVE-2016-1001 (T1219.001)
• CVE-2016-0998 (T1219.001)
• CVE-2015-1641 (T1219.001)
• CVE-2015-1701 (T1570)
• CVE-2015-0313 (T1219.001)
• CVE-2015-0359 (T1134)
• CVE-2015-5130 (T1219.001)
• CVE-2015-5134 (T1219.001)
• CVE-2015-5539 (T1219.001)
• CVE-2015-5557 (T1219.001)
• CVE-2015-5563 (T1219.001)
• CVE-2015-5559 (T1219.001)
• CVE-2015-5540 (T1219.001)
• CVE-2015-5561 (T1219.001)
• CVE-2015-5551 (T1219.001)
• CVE-2015-5564 (T1219.001)
• CVE-2015-5565 (T1219.001)
• CVE-2015-5550 (T1219.001)
• CVE-2015-5566 (T1219.001)
• CVE-2015-5127 (T1219.001)
• CVE-2015-5556 (T1219.001)
• CVE-2015-3628 (T1157)
• CVE-2016-1287 (T1177)
• CVE-2017-0261 (T1134)
• CVE-2017-0262 (T1134)
• CVE-2016-9494 (T1177)
• CVE-2025-55182 (T1219.001)
• CVE-2015-0311 (T1219.001)
• CVE-2013-3906 (T1601.001)
• CVE-2012-0056 (T1157)
• CVE-2010-3333 (T1209)
• CVE-2015-0336 (T1219.001)
• CVE-2014-3153 (T1157)
• CVE-2014-4322 (T1157)
• CVE-2015-3636 (T1157)
• CVE-2013-6282 (T1219.001)
• CVE-2015-3105 (T1219.001)
• CVE-2014-0497 (T1219.001)
• CVE-2013-0074 (T1219.001)
• CVE-2012-0507 (T1219.001)
• CVE-2014-8439 (T1209)
• CVE-2013-2551 (T1219.001)
• CVE-2014-0569 (T1219.001)
• CVE-2014-0515 (T1219.001)
• CVE-2015-0310 (T1219.001)
• CVE-2014-1776 (T1157)
• CVE-2014-0556 (T1219.001)
• CVE-2012-1876 (T1219.001)
• CVE-2015-5560 (T1219.001)
• CVE-2012-2539 (T1219.001)
• CVE-2014-9163 (T1209)
• CVE-2012-1723 (T1219.001)
• CVE-2014-8440 (T1134)
• CVE-2010-0806 (T1547.013)
• CVE-2010-1297 (T1591.004)
• CVE-2010-2884 (T1591.004)
• CVE-2011-3402 (T1219.001)
• CVE-2010-2883 (T1209)
• CVE-2013-0634 (T1097)
• CVE-2014-7247 (T1051)
• CVE-2013-2595 (T1157)
• CVE-2015-4902 (T1059.001)
• CVE-2011-0611 (T1591.004)
• CVE-2013-5990 (T1219.001)
• CVE-2016-0189 (T1601.001)
• CVE-2017-0143 (T1059.001)
• CVE-2025-24893 (T1157)
• CVE-2025-34026 (T1219.001)
• CVE-2025-55183 (T1157)
• CVE-2025-55184 (T1219.001)
• CVE-2014-4113 (T1570)
• CVE-2015-0016 (T1157)
• CVE-2015-2360 (T1570)
• CVE-2015-1427 (T1177)
• CVE-2014-6332 (T1601.001)
• CVE-2015-3456 (T1157)
• CVE-2016-2342 (T1209)
• CVE-2012-0611 (T1219.001)
• CVE-2015-5897 (T1157)
• CVE-2008-1436 (T1656)
• CVE-2015-1770 (T1622)
• CVE-2015-2546 (T1157)
• CVE-2015-3785 (T1219.001)
• CVE-2017-12149 (T1177)
• CVE-2010-1553 (T1209)
• CVE-2015-5477 (T1588.001)
• CVE-2015-8562 (T1177)
• CVE-2015-7808 (T1157)
• CVE-2012-1889 (T1177)
• CVE-2016-1990 (T1157)
• CVE-2016-1991 (T1051)
• CVE-2014-0329 (T1219.001)
• CVE-2015-6034 (T1157)
• CVE-2015-2852 (T1219.001)
• CVE-2015-2854 (T1219.001)
• CVE-2015-2853 (T1219.001)
• CVE-2012-4969 (T1601.001)
• CVE-2015-6585 (T1051)
• CVE-2015-6022 (T1051)
• CVE-2016-1562 (T1612)
• CVE-2017-0263 (T1157)
• CVE-2016-9496 (T1157)
• CVE-2016-9495 (T1177)
• CVE-2017-3212 (T1177)
• CVE-2014-6352 (T1601.001)
• CVE-2012-3213 (T1219.001)
• CVE-2012-4792 (T1547.013)
• CVE-2014-0322 (T1601.001)
• CVE-2012-1258 (T1209)
• CVE-2011-3544 (T1219.001)
• CVE-2014-7911 (T1177)
• CVE-2014-8361 (T1059.001)
• CVE-2017-17215 (T1219.001)
• CVE-2013-2465 (T1219.001)
• CVE-2010-0188 (T1591.004)
• CVE-2012-4681 (T1157)
• CVE-2015-0057 (T1157)
• CVE-2015-0071 (T1219.001)
• CVE-2015-1761 (T1157)
• CVE-2013-3660 (T1157)
• CVE-2013-7331 (T1548.006)
• CVE-2014-4148 (T1219.001)
• CVE-2014-6324 (T1157)
• CVE-2012-5054 (T1177)
• CVE-2013-2678 (T1051)
• CVE-2010-0738 (T1157)
• CVE-2015-2426 (T1219.001)
• CVE-2010-0232 (T1157)
• CVE-2010-4398 (T1209)
• CVE-2013-0641 (T1591.004)
• CVE-2013-0640 (T1591.004)
• CVE-2014-3393 (T1219.001)
• CVE-2012-6422 (T1157)
• CVE-2014-2273 (T1219.001)
• CVE-2014-3897 (T1219.001)
• CVE-2015-2387 (T1157)
• CVE-2009-3129 (T1209)
• CVE-2010-2572 (T1219.001)
• CVE-2011-1255 (T1548.006)
• CVE-2017-8570 (T1219.001)
• CVE-2015-2419 (T1219.001)
• CVE-2016-4117 (T1219.001)
• CVE-2017-0001 (T1157)
• CVE-2017-7255 (T1134)
• CVE-2025-13335 (T1177)
• CVE-2025-13927 (T1157)
• CVE-2025-13928 (T1157)
• CVE-2025-54313 (T1051)
• CVE-2026-0723 (T1219.001)
• CVE-2026-1102 (T1157)
• CVE-2026-20127 (T1157)
• CVE-2025-66478 (T1219.001)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る