G0137 Ferocious Kitten

Ferocious Kitten is a threat group that has primarily targeted Persian-speaking individuals in Iran since at least 2015.¹

Techniques Used

Domain	ID	Name	Use
enterprise	T1583	Acquire Infrastructure	-
enterprise	T1583.001	Domains	Ferocious Kitten has acquired domains imitating legitimate sites.¹
enterprise	T1036	Masquerading	-
enterprise	T1036.002	Right-to-Left Override	Ferocious Kitten has used right-to-left override to reverse executables’ names to make them appear to have different file extensions, rather than their real ones.¹
enterprise	T1036.005	Match Legitimate Name or Location	Ferocious Kitten has named malicious files `update.exe` and loaded them into the compromise host’s “Public” folder.¹
enterprise	T1588	Obtain Capabilities	-
enterprise	T1588.002	Tool	Ferocious Kitten has obtained open source tools for its operations, including JsonCPP and Psiphon.¹
enterprise	T1566	Phishing	-
enterprise	T1566.001	Spearphishing Attachment	Ferocious Kitten has conducted spearphishing campaigns containing malicious documents to lure victims to open the attachments.¹
enterprise	T1204	User Execution	-
enterprise	T1204.002	Malicious File	Ferocious Kitten has attempted to convince victims to enable malicious content within a spearphishing email by including an odd decoy message.¹

ID	Name	References	Techniques
S0190	BITSAdmin	¹	BITS Jobs Exfiltration Over Unencrypted Non-C2 Protocol:Exfiltration Over Alternative Protocol Ingress Tool Transfer Lateral Tool Transfer
S0652	MarkiRAT	¹	Web Protocols:Application Layer Protocol BITS Jobs Registry Run Keys / Startup Folder:Boot or Logon Autostart Execution Shortcut Modification:Boot or Logon Autostart Execution Clipboard Data Windows Command Shell:Command and Scripting Interpreter Password Managers:Credentials from Password Stores Data from Local System Local Data Staging:Data Staged Exfiltration Over C2 Channel File and Directory Discovery Ingress Tool Transfer Keylogging:Input Capture Match Legitimate Name or Location:Masquerading Native API Process Discovery Screen Capture Security Software Discovery:Software Discovery Software Discovery System Information Discovery System Language Discovery:System Location Discovery System Owner/User Discovery