Ajax Security Team
- ID
- G0130
- Associated names
- Operation Woolen-Goldfish, AjaxTM, Rocket Kitten, Flying Kitten, Operation Saffron Rose
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Ajax Security Team is a group that has been active since at least 2010 and believed to be operating out of Iran. By 2014 Ajax Security Team transitioned from website defacement operations to malware-based cyber espionage campaigns targeting the US defense industrial base and Iranian users of anti-censorship technologies.[1]
Techniques used (6)
- T1056.001 Keylogging
- T1105 Ingress Tool Transfer
- T1204.002 Malicious File
- T1555.003 Credentials from Web Browsers
- T1566.001 Spearphishing Attachment
- T1566.003 Spearphishing via Service