Actors/Nation-state / APT/Asia

Pioneer Kitten

APTIR · Iran

AKA Fox Kitten · PARISITE · Br0k3r · RUBIDIUM

Mandiant: UNC757Microsoft: Lemon Sandstorm

IRGC-affiliated cluster involved in espionage and access brokering.

Targets25

Sectors18

Threat types2

GIRs mapped0/480

Active since2017

Explore in atlas

Also tracked as

3 vendor names · 4 other aliases

Open Rosetta Stone

CrowdStrike

Pioneer Kitten

Mandiant

UNC757

Microsoft

Lemon Sandstorm

UNATTRIBUTED ALIASESFox KittenPARISITEBr0k3rRUBIDIUM

Victimology

Geographic footprint · 25 countries

Export STIX

origin · Irantargeted countries · 25

ASIA · 12

United Arab Emirates · China · Indonesia · Israel · India · Macau · Maldives · Philippines · Qatar · Saudi Arabia · Singapore · Taiwan

OCEANIA · 1

Australia

EUROPE · 7

Belgium · Belarus · Switzerland · France · United Kingdom · Ireland · Norway

AMERICAS · 4

Canada · Guatemala · Mexico · United States

AFRICA · 1

Ghana

Sectors targeted

18 of 40

Government100 actors Defense72 actors Aviation22 actors Financial Services73 actors Healthcare46 actors Technology60 actors Telecom71 actors Retail & Hospitality32 actors Energy / Utilities58 actors Education & Research62 actors Manufacturing (man)49 actors Media & Journalism48 actors Transportation31 actors Logistics21 actors Hospitality32 actors Consulting / Professional Services34 actors Industrials / Engineering28 actors Chemicals20 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionageext · Extortion

MITRE ATT&CK · 32 techniques

Resource Development · 1

T1585Establish Accounts

Initial Access · 1

T1190Exploit Public-Facing Application

Execution · 4

T1053.005Scheduled Task

Credential Access · 5

T1003.001LSASS Memory

Discovery · 5

T1012Query Registry T1018Remote System Discovery

Lateral Movement · 5

T1021.001Remote Desktop Protocol T1021.002

Collection · 4

T1005Data from Local System T1039Data from Network Shared Drive T1213.005Messaging Applications

Command And Control · 3

T1090Proxy T1102Web Service

Stealth · 4

T1027.010Command Obfuscation T1036.004Masquerade Task or Service

GIR mappings

0 / 480 requirements mapped

Open matrix

No GIRs mapped yet for this actor.

References

No supporting references have been recorded for this profile. Treat uncited claims as unverified.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer32 techniques · layer format 4.5

Related actors

By origin and actor type

T1059

Command and Scripting Interpreter

T1059.001PowerShell

T1059.003Windows Command Shell

T1003.003

NTDS

T1110Brute Force

T1552.001Credentials In Files

T1555.005Password Managers

T1046

Network Service Discovery

T1083File and Directory Discovery

T1217Browser Information Discovery

SMB/Windows Admin Shares

T1021.004SSH

T1021.005VNC

T1210Exploitation of Remote Services

T1560.001

Archive via Utility

T1105

Ingress Tool Transfer

T1036.005

Match Legitimate Resource Name or Location

T1078Valid Accounts