{
  "id": "fox-kitten",
  "name": "Fox Kitten",
  "aliases": [
    "UNC757",
    "Parisite",
    "Pioneer Kitten",
    "RUBIDIUM",
    "Lemon Sandstorm"
  ],
  "domain": "cyber",
  "country": "IRN",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "IRN"
  ],
  "summary": "Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Suspected nexus to the Iranian government",
      "src": [
        "mitre-g0117"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2017,
      "src": [
        "mitre-g0117"
      ],
      "conf": "medium",
      "note": "At least 2017"
    },
    {
      "k": "attack_id",
      "v": "G0117",
      "src": [
        "mitre-g0117"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.",
      "src": [
        "mitre-g0117"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 41,
      "src": [
        "mitre-g0117"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "China Chopper, ngrok, Pay2Key, PsExec, SystemBC",
      "src": [
        "mitre-g0117"
      ],
      "conf": "high",
      "note": "5 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0117)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/fox-kitten.html",
  "sources": {
    "mitre-g0117": {
      "title": "Fox Kitten, Group G0117",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0117/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}