apt

Fox Kitten

active · last signal 1y agoAttribution: HighWell-corroborated — multiple independent sources or primary reporting.

APT / State-sponsored

Pioneer KittenUNC757ParisiteRUBIDIUMLemon SandstormBr0k3rPay2Key.I2PPay2Key

Attribution

Iran — assessed state-linked, with financially motivated ransomware-affiliate activity (medium-high confidence)

Origin

Iran

First seen

2017

Last active

2026

Motivation

Espionage

Attribution confidence

high

MENA targeting

Israel, Gulf states, global

Sectors

Oil & gas, government, defense, technology

MITRE ATT&CK

G0117 ↗

Why it mattersState-sponsored / APT actor, high confidence, documented targeting Israel, Gulf states, global (Oil & gas, government, defense sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

APT39 / ChaferactorTechnique overlap
Nemesis KittenactorTechnique overlap
OilRig (APT34)actorTechnique overlap
Qilin (fka Agenda)actorTechnique overlap
Agrius (Agonizing Serpens / BlackShadow)actorTechnique overlap
Void Manticore (Storm-0842)actorTechnique overlap
RansomHubactorTechnique overlap
UNC1860actorTechnique overlap

Indicators

No indicators linked yet

IOC extraction runs nightly against new reporting on this actor. Check back after tomorrow's corpus refresh.

Useful?

Typed relationships

Curated links to related activity — not this actor's alias list. Claimed personas are marked unverified; overlap / subgroup edges describe a related but distinct cluster, never the same actor.

Associated operation

Pay2Keymedium confidencesource ↗Pay2Key (ATT&CK S0556) is a ransomware operation/tool attributed to Fox Kitten; the actor-level link rests on medium-confidence single-vendor modelling, so it is typed as a campaign edge, not a merge.

Scarred Manticore (Storm-0861)actorTechnique overlap

Cl0pactorTechnique overlap

APT33actorTechnique overlap

GunraactorTechnique overlap

MontiactorTechnique overlap

HEXANE (Lyceum)actorTechnique overlap

WarlockactorTechnique overlap

SinobiactorTechnique overlap

UNC215actorTechnique overlap

BladedFelineactorTechnique overlap

Crypto24actorTechnique overlap

Stealth FalconactorTechnique overlap

Tropic TrooperactorTechnique overlap

RhysidaactorTechnique overlap

SideWinderactorTechnique overlap

BianLianactorTechnique overlap

Charming Kitten / APT42actorTechnique overlap

Ballistic BobcatactorTechnique overlap

LynxactorTechnique overlap

Earth BogleactorTechnique overlap

Dark CaracalactorTechnique overlap

KillSecactorTechnique overlap

RansomHouseactorTechnique overlap

BrainCipheractorTechnique overlap

WIRTEactorTechnique overlap

Cyber Toufan (Al-Aqsa)actorTechnique overlap

Volatile CedaractorTechnique overlap

Imperial Kitten (CURIUM)actorTechnique overlap

GreenbugactorTechnique overlap

+56 more relationships — see the relationships browser.

Typed relationships

Curated links to related activity — not this actor's alias list. Claimed personas are marked unverified; overlap / subgroup edges describe a related but distinct cluster, never the same actor.

Associated operation

Pay2Keymedium confidencesource ↗Pay2Key (ATT&CK S0556) is a ransomware operation/tool attributed to Fox Kitten; the actor-level link rests on medium-confidence single-vendor modelling, so it is typed as a campaign edge, not a merge.