modified: 2024-01-08T22:00:34.410Z
name: Fox Kitten
description: [Fox Kitten](https://attack.mitre.org/groups/G0117) is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. [Fox Kitten](https://attack.mitre.org/groups/G0117) has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.(Citation: ClearkSky Fox Kitten February 2020)(Citation: CrowdStrike PIONEER KITTEN August 2020)(Citation: Dragos PARISITE )(Citation: ClearSky Pay2Kitten December 2020)
aliases: Fox Kitten
UNC757
Parisite
Pioneer Kitten
RUBIDIUM
Lemon Sandstorm
x_mitre_deprecated: no
x_mitre_version: 2.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--c21dd6f1-1364-4a70-a1f7-783080ec34ee
created: 2020-12-21T21:49:47.307Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0117
external_id: G0117
source_name: UNC757
description: (Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: CrowdStrike PIONEER KITTEN August 2020)
source_name: Pioneer Kitten
description: (Citation: CrowdStrike PIONEER KITTEN August 2020)(Citation: CISA AA20-259A Iran-Based Actor September 2020)
source_name: Parisite
description: (Citation: Dragos PARISITE )(Citation: ClearkSky Fox Kitten February 2020)(Citation: CrowdStrike PIONEER KITTEN August 2020)
source_name: RUBIDIUM
description: (Citation: Microsoft Threat Actor Naming July 2023)
source_name: Lemon Sandstorm
description: (Citation: Microsoft Threat Actor Naming July 2023)
source_name: CISA AA20-259A Iran-Based Actor September 2020
description: CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
url: https://us-cert.cisa.gov/ncas/alerts/aa20-259a
source_name: ClearSky Pay2Kitten December 2020
description: ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
url: https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf
source_name: ClearkSky Fox Kitten February 2020
description: ClearSky. (2020, February 16). Fox Kitten – Widespread Iranian Espionage-Offensive Campaign. Retrieved December 21, 2020.
url: https://www.clearskysec.com/fox-kitten/
source_name: Dragos PARISITE 
description: Dragos. (n.d.). PARISITE. Retrieved December 21, 2020.
url: https://www.dragos.com/threat/parisite/
source_name: Microsoft Threat Actor Naming July 2023
description: Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
url: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
source_name: CrowdStrike PIONEER KITTEN August 2020
description: Orleans, A. (2020, August 31). Who Is PIONEER KITTEN?. Retrieved December 21, 2020.
url: https://www.crowdstrike.com/blog/who-is-pioneer-kitten/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5