Loading IOCs…

{'aliases': ['Fox Kitten',
             'UNC757',
             'Parisite',
             'Pioneer Kitten',
             'RUBIDIUM',
             'Lemon Sandstorm'],
 'created': '2020-12-21T21:49:47.307Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': '[Fox Kitten](https://attack.mitre.org/groups/G0117) is threat '
                'actor with a suspected nexus to the Iranian government that '
                'has been active since at least 2017 against entities in the '
                'Middle East, North Africa, Europe, Australia, and North '
                'America. [Fox Kitten](https://attack.mitre.org/groups/G0117) '
                'has targeted multiple industrial verticals including oil and '
                'gas, technology, government, defense, healthcare, '
                'manufacturing, and engineering.(Citation: ClearkSky Fox '
                'Kitten February 2020)(Citation: CrowdStrike PIONEER KITTEN '
                'August 2020)(Citation: Dragos PARISITE )(Citation: ClearSky '
                'Pay2Kitten December 2020)',
 'external_references': [{'external_id': 'G0117',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/groups/G0117'},
                         {'description': '(Citation: CISA AA20-259A Iran-Based '
                                         'Actor September 2020)(Citation: '
                                         'CrowdStrike PIONEER KITTEN August '
                                         '2020)',
                          'source_name': 'UNC757'},
                         {'description': '(Citation: CrowdStrike PIONEER '
                                         'KITTEN August 2020)(Citation: CISA '
                                         'AA20-259A Iran-Based Actor September '
                                         '2020)',
                          'source_name': 'Pioneer Kitten'},
                         {'description': '(Citation: Dragos PARISITE '
                                         ')(Citation: ClearkSky Fox Kitten '
                                         'February 2020)(Citation: CrowdStrike '
                                         'PIONEER KITTEN August 2020)',
                          'source_name': 'Parisite'},
                         {'description': '(Citation: Microsoft Threat Actor '
                                         'Naming July 2023)',
                          'source_name': 'RUBIDIUM'},
                         {'description': '(Citation: Microsoft Threat Actor '
                                         'Naming July 2023)',
                          'source_name': 'Lemon Sandstorm'},
                         {'description': 'CISA. (2020, September 15). '
                                         'Iran-Based Threat Actor Exploits VPN '
                                         'Vulnerabilities. Retrieved December '
                                         '21, 2020.',
                          'source_name': 'CISA AA20-259A Iran-Based Actor '
                                         'September 2020',
                          'url': 'https://us-cert.cisa.gov/ncas/alerts/aa20-259a'},
                         {'description': 'ClearSky. (2020, December 17). '
                                         'Pay2Key Ransomware – A New Campaign '
                                         'by Fox Kitten. Retrieved December '
                                         '21, 2020.',
                          'source_name': 'ClearSky Pay2Kitten December 2020',
                          'url': 'https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf'},
                         {'description': 'ClearSky. (2020, February 16). Fox '
                                         'Kitten – Widespread Iranian '
                                         'Espionage-Offensive Campaign. '
                                         'Retrieved December 21, 2020.',
                          'source_name': 'ClearkSky Fox Kitten February 2020',
                          'url': 'https://www.clearskysec.com/fox-kitten/'},
                         {'description': 'Dragos. (n.d.). PARISITE. Retrieved '
                                         'December 21, 2020.',
                          'source_name': 'Dragos PARISITE ',
                          'url': 'https://www.dragos.com/threat/parisite/'},
                         {'description': 'Microsoft . (2023, July 12). How '
                                         'Microsoft names threat actors. '
                                         'Retrieved November 17, 2023.',
                          'source_name': 'Microsoft Threat Actor Naming July '
                                         '2023',
                          'url': 'https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide'},
                         {'description': 'Orleans, A. (2020, August 31). Who '
                                         'Is PIONEER KITTEN?. Retrieved '
                                         'December 21, 2020.',
                          'source_name': 'CrowdStrike PIONEER KITTEN August '
                                         '2020',
                          'url': 'https://www.crowdstrike.com/blog/who-is-pioneer-kitten/'}],
 'id': 'intrusion-set--c21dd6f1-1364-4a70-a1f7-783080ec34ee',
 'modified': '2024-01-08T22:00:34.410Z',
 'name': 'Fox Kitten',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'intrusion-set',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_deprecated': False,
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_version': '2.0'}