Ferocious Kitten

MITRE ATT&CK: G0137 View on attack.mitre.org

Aliases: Ferocious Kitten

First seen
2015-01-01 00:00:00
Origin
IR
Primary motivation
espionage
Sophistication
intermediate
Resource level
organization
Actor type
nation-state
Profile updated
2026-07-07 12:13:50

Targeted industries: government-and-public-sector media-and-entertainment

Targeted regions: country_code:ir

Context

Ferocious Kitten is a threat group that has primarily targeted Persian-speaking individuals in Iran since at least 2015.

Detection coverage

  • 1 YARA rules
  • 72 Sigma rules

Malware & tools used

  • Malicious File (attack-pattern)
  • Right-to-Left Override (attack-pattern)
  • Match Legitimate Resource Name or Location (attack-pattern)
  • Spearphishing Attachment (attack-pattern)
  • Tool (attack-pattern)
  • Domains (attack-pattern)
  • MarkiRAT (malware)
  • BITSAdmin (malware)

Reports & references

  • Kaspersky — 102806 (report)
  • MITRE ATT&CK — G0137 (report)

External references