Ajax Security Team

MITRE ATT&CK: G0130 View on attack.mitre.org

Aliases: Operation Woolen-Goldfish, AjaxTM, Rocket Kitten, Flying Kitten, Operation Saffron Rose, SaffronRose, Saffron Rose, AjaxSecurityTeam, Ajax Security Team, Group 26, Sayad, TEMP.Beanie, Operation Woolen Goldfish, Thamar Reservoir, Timberworm

First seen
2010-01-01 00:00:00
Origin
IR
Primary motivation
espionage
Sophistication
intermediate
Resource level
team
Actor type
Espionage
Last IoC activity
2026-07-03 01:02:41
Profile updated
2026-07-07 12:31:02

Targeted industries: defense-and-aerospace government-and-public-sector technology-and-telecommunications

Targeted regions: country_code:us country_code:ir

Context

Ajax Security Team is a group that has been active since at least 2010 and believed to be operating out of Iran. By 2014 Ajax Security Team transitioned from website defacement operations to malware-based cyber espionage campaigns targeting the US defense industrial base and Iranian users of anti-censorship technologies.

Detection coverage

  • 126 Sigma rules

Malware & tools used

  • Keylogging (attack-pattern)
  • Spearphishing via Service (attack-pattern)
  • Spearphishing Attachment (attack-pattern)
  • Malicious File (attack-pattern)
  • Credentials from Web Browsers (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • sqlmap (malware)
  • Havij (malware)

Related threat objects

Reports & references

  • Mandiant — Rpt Operation Saffron Rose (report)
  • CrowdStrike — Cat Scratch Fever Crowdstrike Tracks Newly Reported Iranian Actor Flying Kitten (report)
  • cfr.org — Saffron Rose (report)
  • Trend Micro — Operation Woolen Goldfish When Kittens Go Phishing (report)
  • Trend Micro — Wp The Spy Kittens Are Back (report)
  • clearskysec.com — Thamar Reservoir (report)
  • citizenlab.ca — Iran Two Factor Phishing (report)
  • blog.checkpoint.com — Rocket Kitten Report (report)
  • Broadcom/Symantec — Viewdocument (report)
  • researchcenter.paloaltonetworks.com — Unit42 Magic Hound Campaign Attacks Saudi Targets (report)
  • Wikipedia — Rocket Kitten (report)
  • cfr.org — Rocket Kitten (report)
  • MITRE ATT&CK — G0130 (report)
  • Trend Micro — Wp Operation Woolen Goldfish (report)
  • iranthreats.github.io — Attribution Flying Rocket Kitten (report)
  • Mandiant — Rpt Operation Saffron Rose (report)

External references