Ferocious Kitten is an Iran-nexus surveillance group disclosed by Kaspersky in 2021 that conducted years of covert targeting of Persian-speaking individuals inside Iran using the MarkiRAT implant delivered via decoy documents. Sourcing is thin (single primary vendor).
Additional names this actor is known by across other vendors' naming schemes — cross-referenced from external crosswalk sources, not RaqibCTI's own curated aliases (shown at the top of this page). Each source is attributed to its own licence.
Ferocious Kitten was documented by Kaspersky in June 2021, which described roughly six years of covert surveillance (from around 2015) aimed at Persian-speaking individuals believed to be based in Iran. Confidence is low-medium and flagged: the group rests largely on a single primary vendor report, with limited independent corroboration, and has no MITRE Group ID; Kaspersky noted possible thematic overlaps with other Iran-linked domestic-surveillance activity (e.g. Domestic Kitten) without firmly merging them.
The group's tradecraft relied on social engineering via malicious documents — including lures with political and activist themes — that delivered the MarkiRAT implant. MarkiRAT logs keystrokes and clipboard data, steals files, and can hijack the launch of Telegram and Chrome to maintain persistence and monitor communications, providing sustained visibility into targets' activity. The tooling was relatively simple but effective against individuals rather than hardened enterprise networks.
MENA relevance is defined by its exclusively Iran-focused, domestic victimology: the operation targeted Persian-speaking users inside Iran, consistent with an internal-repression and dissident-monitoring mission rather than foreign strategic espionage — situating Ferocious Kitten within Iran's ecosystem of citizen-surveillance actors.
No distinct Ferocious Kitten activity has been prominently reported since the 2021 disclosure, so it is assessed as dormant. It is included as a single-source Iranian domestic-surveillance historical entry, explicitly flagged low-medium confidence and G-ID-less.