Ajax Security Team

Suspected state-linked cyber threat groupTrackedPending verification

Also known as: Operation Woolen-Goldfish, AjaxTM, Rocket Kitten, Flying Kitten, Operation Saffron Rose

CyberIRN

Identification silhouette. Not drawn to scale between entries.

Fact cardConfidence · Source

System

TypeSuspected state-linked cyber threat group

Alternative designationsOperation Woolen-Goldfish, AjaxTM, Rocket Kitten, Flying Kitten, Operation Saffron Rose

ProliferationOrigin country only

Active since2010At least 2010Med^[1]

MITRE ATT&CK IDG0130High^[1]

Capabilities

ATT&CK techniques used6ATT&CK v20.1High^[1]

Malware and toolsHavij, sqlmap2 malware and tool entries linked in ATT&CKHigh^[1]

Attribution and activity

Attributed sponsorBelieved to operate from IranMed^[1]

TargetsBy 2014 Ajax Security Team transitioned from website defacement operations to malware-based cyber espionage campaigns targeting the US defense industrial base and Iranian users of anti-censorship technologies.Med^[1]

Notes

Ajax Security Team is a group that has been active since at least 2010 and believed to be operating out of Iran. By 2014 Ajax Security Team transitioned from website defacement operations to malware-based cyber espionage campaigns targeting the US defense industrial base and Iranian users of anti-censorship technologies. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.

Summary

Draft entry. Values come from the cited public sources and are awaiting editor verification.

Compare JSON

Operators

Iran

Sources

Ajax Security Team, Group G0130, MITRE ATT&CK
Published/updated 2026-07-31 · Tier 2 · checked 2026-11-08

Change log

2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G0130)