ETDA ThaiCERT
Report
Search
Home > List all groups > Flying Kitten, Ajax Security Team

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link APT group: Flying Kitten, Ajax Security Team

NamesFlying Kitten (CrowdStrike)
Ajax Security Team (FireEye)
Group 26 (Talos)
CountryIran Iran
SponsorState-sponsored
MotivationInformation theft and espionage
First seen2010
Description(FireEye) Members of this group have accounts on popular Iranian hacker forums such as ashiyane[.]org and shabgard[.]org, and they have engaged in website defacements under the group name “AjaxTM” since 2010. By 2014, the Ajax Security Team had transitioned from performing defacements (their last defacement was in December 2013) to malware-based espionage, using a methodology consistent with other advanced persistent threat actors in this region.

(Crowdstrike) CrowdStrike Intelligence has also been tracking and reporting internally on this threat group since mid-January 2014 under the name FLYING KITTEN, and since that time has seen targeting of multiple U.S.-based defense contractors as well as political dissidents.
ObservedSectors: Defense and dissidents.
Countries: USA.
Tools usedStealer.
Operations performed2013Operation “Saffron Rose”
<https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-operation-saffron-rose.pdf>
Information<https://www.crowdstrike.com/blog/cat-scratch-fever-crowdstrike-tracks-newly-reported-iranian-actor-flying-kitten/>

Last change to this card: 14 April 2020

Download this actor card in PDF or JSON format

Previous: Fishing Elephant
Next: FunnyDream

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key