Flying Kitten
Also known as SaffronRose, Saffron Rose, AjaxSecurityTeam, Ajax Security Team, Group 26, Sayad, Operation Woolen-Goldfish, AjaxTM, Rocket Kitten, Operation Saffron Rose
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
Activity: defense and aerospace sectors, also interested in targeting entities in the oil/gas industry.
Targets: Military, Civil society, United States, Iranian internet activists
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1056.001 KeyloggingT1105 Ingress Tool TransferT1204.002 Malicious FileT1555.003 Credentials from Web BrowsersT1566.001 Spearphishing AttachmentT1566.003 Spearphishing via Service
Recent activity
No posts or advisories have named this actor recently.
References
- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-operation-saffron-rose.pdf
- https://www.crowdstrike.com/blog/cat-scratch-fever-crowdstrike-tracks-newly-reported-iranian-actor-flying-kitten/
- https://www.cfr.org/interactive/cyber-operations/saffron-rose
- https://attack.mitre.org/groups/G0130
- https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf
- https://documents.trendmicro.com/assets/wp/wp-operation-woolen-goldfish.pdf
- https://iranthreats.github.io/resources/attribution-flying-rocket-kitten/
- https://www.mandiant.com/sites/default/files/2021-09/rpt-operation-saffron-rose.pdf
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.