apt

Flying Kitten

Attribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

Ajax Security TeamOperation Saffron RoseRocket Kitten-adjacent

Attribution

Iran — assessed state-aligned, evolved from a hacktivist collective (medium confidence; no MITRE Group ID)

Origin

Iran

First seen

2013

Last active

2014

Motivation

Espionage

Attribution confidence

medium

MENA targeting

Iran (dissidents), regional Persian-language targets

Sectors

Defense, dissidents/individuals

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Iran (dissidents), regional Persian-language targets (Defense, dissidents/individuals sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

Rocket KittenactorTechnique overlap
Ferocious KittenactorTechnique overlap
Madi / MahdiactorTechnique overlap
Infy / Prince of PersiaactorTechnique overlap
Careto / MaskactorTechnique overlap
Arid Viper (APT-C-23 / Desert Falcon)actorTechnique overlap
BahamutactorTechnique overlap
APT39 / ChaferactorTechnique overlap

Coverage robustness · vs this actor

How evasion-resistant our detection coverage is against Flying Kitten's techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.

Techniques with a robust rule

Techniques with any detection

2 / 5

Mean robustness (of covered)

Useful?