TRACER KITTEN

Executive Summary

TRACER KITTEN is an Iran-based adversary conducting malicious activities against telecommunications companies in the EMEA region. Using valid user accounts and custom backdoors with SSH tunnels, they compromise systems for reconnaissance, credential harvesting, and potential data exfiltration, posing significant risks to critical infrastructure.

Goals & Targeting

TRACER KITTEN likely targets the telecommunications sector to gain access to critical infrastructure, potentially for economic advantage, espionage, or strategic disruption. Their focus on EMEA regions may be linked to geopolitical interests or regional influence, aiming to gather sensitive information or disrupt services.

TRACER KITTEN was first identified by CrowStrike Falcon OverWatch in April 2020 targeting a telecommunications company across Europe, Middle East, and Africa. Operating under valid user credentials, the group employed custom backdoors and SSH tunnels for command and control (C2), enabling persistence and covert communication. Their activities included extensive reconnaissance, credential harvesting, and preparation for data exfiltration, indicating a capability to disrupt or compromise sensitive infrastructure. The use of custom tools suggests a degree of sophistication tailored to specific campaigns.

Key Capabilities

• Custom backdoors
• SSH tunnels for C2
• Valid user account compromise
• Credential harvesting
• Network reconnaissance

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

TRACER KITTEN operates with a focus on long-term access and data gathering, targeting critical sectors. Campaigns likely involve prolonged presence to facilitate data exfiltration, suggesting state-sponsored activity. Notable for their blend of custom tools and persistence mechanisms, they pose risks to telecommunications globally.

IOC Patterns

• Custom backdoor binaries
• SSH tunnel anomalies
• Unusual account activity
• Lateral movement patterns

Recommended Actions

• Implement multi-factor authentication (MFA) for critical accounts
• Monitor network traffic for SSH tunnel anomalies
• Conduct regular system audits and update firmware/software
• Enhance network segmentation to limit lateral movement

Suggested Tags