Ferocious Kitten

Executive Summary

Ferocious Kitten is a cyber threat group primarily targeting Persian-speaking individuals in Iran since at least 2015. The group has demonstrated persistence over time, focusing on discreetly gathering information and maintaining operational security. Their activities align with data collection and espionage objectives, making them a significant concern for organizations and individuals within their target demographic.

Goals & Targeting

Ferocious Kitten's strategic objectives likely include intelligence collection and surveillance, targeting individuals and entities in Iran that could provide sensitive information. Their focus on Persians speaking indicates a regional or cultural specificity in their operations. The group's victims appear to be concentrated in Iran, implying a potential state-backed operation or a highly targeted criminal endeavor focused on discreetly gathering information.

Ferocious Kitten is a cyber threat actor that has been active since at least 2015, with primary operations targeting Persian-speaking populations in Iran. The group's activities have been linked to various malicious software tools and attack techniques, including the use of MarkiRAT malware. Ferocious Kitten's tactics are designed to remain elusive, leveraging TTPs such as right-to-left override (RLO) attacks and domain name abuse to avoid detection. The group's focus on Persian-speaking individuals suggests a potential emphasis on surveillance or espionage within Iran.

Key Capabilities

• Use of MarkiRAT malware
• Right-to-left (RLO) text spoofing attacks
• Domain name abuse for command and control
• Spear-phishing via malicious files

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Ferocious Kitten has conducted persistent campaigns targeting Persian-speaking individuals in Iran since at least 2015. Their operations are characterized by their use of RLO attacks and MarkiRAT malware, suggesting a focus on long-term intelligence gathering. Despite their longevity, little is known about their specific campaigns or victims beyond their primary geographic focus.

IOC Patterns

• Spear-phishing with attachments
• Malicious file downloads
• Right-to-left (RLO) override attacks
• Abuse of legitimate domain names
• C2 communications via compromised domains

Recommended Actions

• Implement RTO detection mechanisms to identify RLO attacks.
• Monitor for suspicious activity using known MarkiRAT indicators.
• Enhance user training on identifying phishing attempts and RTO spoofing.
• Conduct regular network monitoring for unusual file downloads or domain usage.
• Apply multi-factor authentication (MFA) where possible.

Suggested Tags