modified: 2023-10-09T16:46:55.719Z
name: Ajax Security Team
description: [Ajax Security Team](https://attack.mitre.org/groups/G0130) is a group that has been active since at least 2010 and believed to be operating out of Iran. By 2014 [Ajax Security Team](https://attack.mitre.org/groups/G0130) transitioned from website defacement operations to malware-based cyber espionage campaigns targeting the US defense industrial base and Iranian users of anti-censorship technologies.(Citation: FireEye Operation Saffron Rose 2013)
aliases: Ajax Security Team
Operation Woolen-Goldfish
AjaxTM
Rocket Kitten
Flying Kitten
Operation Saffron Rose
x_mitre_deprecated: no
x_mitre_version: 1.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--fa19de15-6169-428d-9cd6-3ca3d56075b7
created: 2021-04-14T13:17:43.941Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0130
external_id: G0130
source_name: Flying Kitten
description: (Citation: CrowdStrike Flying Kitten )
source_name: AjaxTM
description: (Citation: FireEye Operation Saffron Rose 2013)
source_name: Operation Saffron Rose
description: (Citation: FireEye Operation Saffron Rose 2013)
source_name: Rocket Kitten
description: Analysis of infrastructure, tools, and modes of operation revealed a potential relationship between [Ajax Security Team](https://attack.mitre.org/groups/G0130) and Rocket Kitten.(Citation: Check Point Rocket Kitten)(Citation: IranThreats Kittens Dec 2017)
source_name: Operation Woolen-Goldfish
description: Analysis of infrastructure, tools, and modes of operation revealed a potential relationship between [Ajax Security Team](https://attack.mitre.org/groups/G0130) and the campaign Operation Woolen-Goldfish.(Citation: Check Point Rocket Kitten)(Citation: TrendMicro Operation Woolen Goldfish March 2015)
source_name: TrendMicro Operation Woolen Goldfish March 2015
description: Cedric Pernet, Kenney Lu. (2015, March 19). Operation Woolen-Goldfish - When Kittens Go phishing. Retrieved April 21, 2021.
url: https://documents.trendmicro.com/assets/wp/wp-operation-woolen-goldfish.pdf
source_name: Check Point Rocket Kitten
description: Check Point Software Technologies. (2015). ROCKET KITTEN: A CAMPAIGN WITH 9 LIVES. Retrieved March 16, 2018.
url: https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf
source_name: CrowdStrike Flying Kitten 
description: Dahl, M.. (2014, May 13). Cat Scratch Fever: CrowdStrike Tracks Newly Reported Iranian Actor as FLYING KITTEN. Retrieved May 27, 2020.
url: https://www.crowdstrike.com/blog/cat-scratch-fever-crowdstrike-tracks-newly-reported-iranian-actor-flying-kitten/
source_name: IranThreats Kittens Dec 2017
description: Iran Threats . (2017, December 5). Flying Kitten to Rocket Kitten, A Case of Ambiguity and Shared Code. Retrieved May 28, 2020.
url: https://iranthreats.github.io/resources/attribution-flying-rocket-kitten/
source_name: FireEye Operation Saffron Rose 2013
description: Villeneuve, N. et al.. (2013). OPERATION SAFFRON ROSE . Retrieved May 28, 2020.
url: https://www.mandiant.com/sites/default/files/2021-09/rpt-operation-saffron-rose.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5