RedKitten
- First seen
- 2026-01-01 00:00:00
- Primary motivation
- ideology
- Sophistication
- advanced
- Resource level
- government
- Actor type
- nation-state
- Profile updated
- 2026-07-07 12:25:04
Targeted industries: education-and-nonprofits
Targeted regions: country_code:ir
Context
RedKitten is a campaign targeting Iranian interests, particularly NGOs and individuals documenting human rights abuses, first observed in January 2026. The malware utilizes GitHub and Google Drive for configuration and payload retrieval, while employing Telegram for command and control. Although precise attribution is challenging, the activity exhibits TTPs associated with Iranian state-sponsored actors and linguistic indicators suggest a Farsi-speaking threat actor. RedKitten is characterized as an AI-accelerated campaign exploiting the humanitarian crisis surrounding Iran’s Dey 1404 protests.
Reports & references
- harfanglab.io — Redkitten Ai Accelerated Campaign Targeting Iranian Protests (report)