Fox Kitten
- ID
- G0117
- Associated names
- UNC757, Parisite, Pioneer Kitten, RUBIDIUM, Lemon Sandstorm
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.[1][2][3][4]
Techniques used (41)
- T1003.001 LSASS Memory
- T1003.003 NTDS
- T1005 Data from Local System
- T1012 Query Registry
- T1018 Remote System Discovery
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1021.004 SSH
- T1021.005 VNC
- T1027.010 Command Obfuscation
- T1027.013 Encrypted/Encoded File
- T1036.004 Masquerade Task or Service
- T1036.005 Match Legitimate Resource Name or Location
- T1039 Data from Network Shared Drive
- T1046 Network Service Discovery
- T1053.005 Scheduled Task
- T1059 Command and Scripting Interpreter
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1078 Valid Accounts
- T1083 File and Directory Discovery
- T1087.001 Local Account
- T1087.002 Domain Account
- T1090 Proxy
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1110 Brute Force
- T1136.001 Local Account
- T1190 Exploit Public-Facing Application
- T1210 Exploitation of Remote Services
- T1213.005 Messaging Applications
- T1217 Browser Information Discovery
- T1505.003 Web Shell
- T1530 Data from Cloud Storage
- T1546.008 Accessibility Features
- T1552.001 Credentials In Files
- T1555.005 Password Managers
- T1560.001 Archive via Utility
- T1572 Protocol Tunneling
- T1585 Establish Accounts
- T1585.001 Social Media Accounts