Fox Kitten
IntrusionSet · ATTACK:enterprise:G0117
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0117",
"title": "Fox Kitten",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0117",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--c21dd6f1-1364-4a70-a1f7-783080ec34ee",
"external_id": "G0117",
"domain": "enterprise",
"created": "2020-12-21T21:49:47.307Z",
"modified": "2026-07-31T18:48:16.208Z",
"version": "2.0",
"aliases": [
"Fox Kitten",
"UNC757",
"Parisite",
"Pioneer Kitten",
"RUBIDIUM",
"Lemon Sandstorm"
],
"tactics": [
],
"source_references": [
{
"source_name": "UNC757"
},
{
"source_name": "Pioneer Kitten"
},
{
"source_name": "Parisite"
},
{
"source_name": "RUBIDIUM"
},
{
"source_name": "Lemon Sandstorm"
},
{
"source_name": "CISA AA20-259A Iran-Based Actor September 2020",
"url": "https://us-cert.cisa.gov/ncas/alerts/aa20-259a"
},
{
"source_name": "ClearSky Pay2Kitten December 2020",
"url": "https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"
},
{
"source_name": "ClearkSky Fox Kitten February 2020",
"url": "https://www.clearskysec.com/fox-kitten/"
},
{
"source_name": "Dragos PARISITE ",
"url": "https://www.dragos.com/threat/parisite/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "CrowdStrike PIONEER KITTEN August 2020",
"url": "https://www.crowdstrike.com/blog/who-is-pioneer-kitten/"
}
]
}Explicit source assertions (46)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00de3cf9-73c4-4b04-a074-a5d73e9b61de
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1059
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00fb61de-33f5-4e85-aca3-8e4016aa0bf8
ClearSky Pay2Kitten December 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1530
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--118c566e-2042-4566-99c2-308351d50a40
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1374e38c-db37-46f8-8560-63901a3e7e56
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1110
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b4baaaa-f08e-4f67-8d32-a7facb21eb7b
ClearSky Pay2Kitten December 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1210
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1cfc2e72-a9ce-4dc2-95ad-fb99c90a2880
ClearkSky Fox Kitten February 2020 · CrowdStrike PIONEER KITTEN August 2020 · ClearSky Pay2Kitten December 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1136.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--26ce5847-3f53-4736-92c6-7a82e17cd884
ClearSky Pay2Kitten December 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--28d9ac63-ce5f-4d42-be72-6b4d99b6fda7
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2904937b-f1ed-4fa8-87e9-a7d69cbccc27
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--32bc85f6-f022-4868-8934-bd00cc36f6d4
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1585
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--340a62c8-9f22-4cb6-9310-bd4136e14258
ClearSky Pay2Kitten December 2020 · Check Point Pay2Key November 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1021.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3d3ea12b-fec0-4daa-bb51-190884d88ee0
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1552.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4dbf47c1-c065-4e4c-8894-376d636555a2
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1217
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--52ecf0cd-4e5f-4331-b4d8-42618f155c5c
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54b2d2db-b1d8-49aa-82f3-08d8a53a4899
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5fa15bc3-e7ec-4617-bf30-b5258af8b2ec
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1213.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--628054bd-e758-4528-a1fb-40983ecec149
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1021.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65e9d954-30d8-4354-ad5c-3a6d69867a7e
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:S0020
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68efc544-05be-454e-86e9-18d55c7d0f2b
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d4f3696-caa9-4100-bef5-e42d0f18470e
ClearkSky Fox Kitten February 2020 · Dragos PARISITE · CrowdStrike PIONEER KITTEN August 2020 · CISA AA20-259A Iran-Based Actor September 2020 · ClearSky Pay2Kitten December 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1555.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--70fe7f39-41de-4d7d-b691-4ac17c1a4c58
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1003.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71b92fe6-dd99-4192-b327-8ef27b790123
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1087.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8a4b2f39-183a-40e9-a8af-f3727061c17d
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1087.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b425ec5-7be4-4225-a7c5-8f219fed7b6c
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91b41079-6c44-439e-a76c-2a128a792e17
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1505.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96772bc0-7a9e-4688-95a2-67fff1646be4
CISA AA20-259A Iran-Based Actor September 2020 · ClearSky Pay2Kitten December 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--99c87be1-d8f1-4b41-836f-8811628c4b80
CISA AA20-259A Iran-Based Actor September 2020 · ClearSky Pay2Kitten December 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a27943d2-6839-4be3-81ea-19ea6704d218
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:S0556
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a391b999-a7f9-439d-bed5-0a0a13bb6f7d
ClearkSky Fox Kitten February 2020 · Check Point Pay2Key November 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a3b4a3e9-2552-43dc-957a-5c7f64fac9f1
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1090
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a637133c-2b07-4e57-8822-5c3bc4b584d7
CISA AA20-259A Iran-Based Actor September 2020 · ClearSky Pay2Kitten December 2020 · Check Point Pay2Key November 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b8b16140-82bc-42a0-82f7-bfc402f4b4a4
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bdaf3340-0580-4e89-9cdc-e0af5a91ed85
CrowdStrike PIONEER KITTEN August 2020 · CISA AA20-259A Iran-Based Actor September 2020 · ClearSky Pay2Kitten December 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:S0508
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d18f30d7-deca-457c-b993-c87843ae3bab
CrowdStrike PIONEER KITTEN August 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d32354c1-0668-4997-825e-7f5652826ab9
CISA AA20-259A Iran-Based Actor September 2020 · ClearSky Pay2Kitten December 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1102
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d452da85-b408-458f-ad25-937605de4611
ClearSky Pay2Kitten December 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d51c9d02-a701-4334-9dbc-bba6c128ba2b
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:S0029
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9a97894-9a90-43cd-b9b9-9d13545aeb5a
CISA AA20-259A Iran-Based Actor September 2020 · Check Point Pay2Key November 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db08c6bc-0a2a-41f3-bcb2-5410f9e0afa6
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1046
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dd0c5079-1bd3-45fa-b8e7-aabf0a5513b7
CISA AA20-259A Iran-Based Actor September 2020 · ClearSky Pay2Kitten December 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1546.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--df898edd-0829-4222-b50b-e7cbf75a0fb4
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1585.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e463f5ae-4b7a-40dd-94e1-1a04a22e5e23
ClearSky Pay2Kitten December 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e51ab951-2e6f-4c7e-bd10-fe0dc0bb4671
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:S9001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9bcda68-7633-4531-a7f2-e1b117d0e559
FortinetEtAl_IranianIntrusion_Mar2025ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ecc9a971-349b-428d-a376-74f11b5b7086
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f0026b7c-9a9a-468d-a152-1b214efe066a
CISA AA20-259A Iran-Based Actor September 2020