{
	"id": "cfa85d23-c009-4fa9-b4c7-4b9e509a699d",
	"created_at": "2026-04-06T01:31:14.456722Z",
	"updated_at": "2026-04-10T13:13:01.48623Z",
	"deleted_at": null,
	"sha1_hash": "326af32d3077ee99069824100328d5110e0a724e",
	"title": "Parisite, Fox Kitten, Pioneer Kitten",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 32879,
	"plain_text": "Parisite, Fox Kitten, Pioneer Kitten\r\nArchived: 2026-04-06 01:07:18 UTC\r\nDescription“This group has operated since at least 2017 based on infrastructure Dragos identified,” the report\r\nexplained. “Parisite serves as the initial access group and enables further operations for APT 33, Elfin,\r\nMagnallium.”\r\n(ClearSky) During the last quarter of 2019, ClearSky research team has uncovered a widespread Iranian offensive\r\ncampaign which we call “Fox Kitten Campaign”; this campaign is being conducted in the last three years against\r\ndozens of companies and organizations in Israel and around the world. Though the campaign, the attackers\r\nsucceeded in gaining access and persistent foothold in the networks of numerous companies and organizations\r\nfrom the IT,Telecommunication,Oil and Gas, Aviation, Government, and Security sectors around the world.\r\nDuring our analysis, we have found an overlap, with medium-high probability, between this campaign’s\r\ninfrastructure and the activity of an Iranian offensive group OilRig, APT 34, Helix Kitten, Chrysene. Additionally,\r\nwe have identified, with medium probability, a connection between this campaign and the APT 33, Elfin,\r\nMagnallium and Chafer, APT 39 groups.The campaign was first revealed by Dragos, named “Parisite”and\r\nattributed to APT33; we call the comprehensive campaign revealed in this report “Fox Kitten”.\r\nThe initial breach of the targeted organizations was performed, in most cases, by exploiting 1-day vulnerabilities\r\nin different VPN services such as: Pulse Secure VPN, Fortinet VPN, and Global Protect by Palo Alto Networks.\r\nUpon gaining foothold at the target, the attackers tried to maintain the access to the networks by opening a variety\r\nof communication tools, including opening RDP links over SSH tunneling, in order to camouflage and encrypt the\r\ncommunication with the targets. At the final stage, after successfully infiltrating the organization, the attackers\r\nhave performed a routine process of identification, examination, and filtering of sensitive, valuable information\r\nfrom every targeted organization.The valuable information was sent back to the attackers for reconnaissance,\r\nespionage, or further infection of connected networks.\r\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=9d13d133-e25a-4de0-8952-6b0cbdb92899\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=9d13d133-e25a-4de0-8952-6b0cbdb92899\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=9d13d133-e25a-4de0-8952-6b0cbdb92899"
	],
	"report_names": [
		"showcard.cgi?u=9d13d133-e25a-4de0-8952-6b0cbdb92899"
	],
	"threat_actors": [
		{
			"id": "62947fad-14d2-40bf-a721-b1fc2fbe5b5d",
			"created_at": "2025-08-07T02:03:24.741594Z",
			"updated_at": "2026-04-10T02:00:03.653394Z",
			"deleted_at": null,
			"main_name": "COBALT HICKMAN",
			"aliases": [
				"APT39 ",
				"Burgundy Sandstorm ",
				"Chafer ",
				"ITG07 ",
				"Remix Kitten "
			],
			"source_name": "Secureworks:COBALT HICKMAN",
			"tools": [
				"MechaFlounder",
				"Mimikatz",
				"Remexi",
				"TREKX"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "a63c994f-d7d6-4850-a881-730635798b90",
			"created_at": "2025-08-07T02:03:24.788883Z",
			"updated_at": "2026-04-10T02:00:03.785146Z",
			"deleted_at": null,
			"main_name": "COBALT TRINITY",
			"aliases": [
				"APT33 ",
				"Elfin ",
				"HOLMIUM ",
				"MAGNALIUM ",
				"Peach Sandstorm ",
				"Refined Kitten ",
				"TA451 "
			],
			"source_name": "Secureworks:COBALT TRINITY",
			"tools": [
				"AutoCore",
				"Cadlotcorg",
				"Dello RAT",
				"FalseFont",
				"Imminent Monitor",
				"KDALogger",
				"Koadic",
				"NanoCore",
				"NetWire",
				"POWERTON",
				"PoshC2",
				"Poylog",
				"PupyRAT",
				"Schoolbag"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "cffb3c01-038f-4527-9cfd-57ad5a035c22",
			"created_at": "2022-10-25T15:50:23.38055Z",
			"updated_at": "2026-04-10T02:00:05.258283Z",
			"deleted_at": null,
			"main_name": "OilRig",
			"aliases": [
				"COBALT GYPSY",
				"IRN2",
				"APT34",
				"Helix Kitten",
				"Evasive Serpens",
				"Hazel Sandstorm",
				"EUROPIUM",
				"ITG13",
				"Earth Simnavaz",
				"Crambus",
				"TA452"
			],
			"source_name": "MITRE:OilRig",
			"tools": [
				"ISMInjector",
				"ODAgent",
				"RDAT",
				"Systeminfo",
				"QUADAGENT",
				"OopsIE",
				"ngrok",
				"Tasklist",
				"certutil",
				"ZeroCleare",
				"POWRUNER",
				"netstat",
				"Solar",
				"ipconfig",
				"LaZagne",
				"BONDUPDATER",
				"SideTwist",
				"OilBooster",
				"SampleCheck5000",
				"PsExec",
				"SEASHARPEE",
				"Mimikatz",
				"PowerExchange",
				"OilCheck",
				"RGDoor",
				"ftp"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "2c348851-5036-406b-b2d1-1ca47cfc7523",
			"created_at": "2022-10-25T16:07:24.039861Z",
			"updated_at": "2026-04-10T02:00:04.847961Z",
			"deleted_at": null,
			"main_name": "Parisite",
			"aliases": [
				"Cobalt Foxglove",
				"Fox Kitten",
				"G0117",
				"Lemon Sandstorm",
				"Parisite",
				"Pioneer Kitten",
				"Rubidium",
				"UNC757"
			],
			"source_name": "ETDA:Parisite",
			"tools": [
				"Cobalt",
				"FRP",
				"Fast Reverse Proxy",
				"Invoke the Hash",
				"JuicyPotato",
				"Ngrok",
				"POWSSHNET",
				"Pay2Key",
				"Plink",
				"Port.exe",
				"PuTTY Link",
				"SSHMinion",
				"STSRCheck",
				"Serveo"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "bee22874-f90e-410b-93f3-a2f9b1c2e695",
			"created_at": "2022-10-25T16:07:23.45097Z",
			"updated_at": "2026-04-10T02:00:04.610108Z",
			"deleted_at": null,
			"main_name": "Chafer",
			"aliases": [
				"APT 39",
				"Burgundy Sandstorm",
				"Cobalt Hickman",
				"G0087",
				"ITG07",
				"Radio Serpens",
				"Remix Kitten",
				"TA454"
			],
			"source_name": "ETDA:Chafer",
			"tools": [
				"ASPXSpy",
				"ASPXTool",
				"Antak",
				"CACHEMONEY",
				"EternalBlue",
				"HTTPTunnel",
				"LOLBAS",
				"LOLBins",
				"Living off the Land",
				"MechaFlounder",
				"Metasploit",
				"Mimikatz",
				"NBTscan",
				"NSSM",
				"Non-sucking Service Manager",
				"POWBAT",
				"Plink",
				"PuTTY Link",
				"Rana",
				"Remcom",
				"Remexi",
				"RemoteCommandExecution",
				"SafetyKatz",
				"UltraVNC",
				"WCE",
				"Windows Credential Editor",
				"Windows Credentials Editor",
				"nbtscan",
				"pwdump"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "25896473-161f-411f-b76a-f11bb26c96bd",
			"created_at": "2023-01-06T13:46:38.75749Z",
			"updated_at": "2026-04-10T02:00:03.090307Z",
			"deleted_at": null,
			"main_name": "CHRYSENE",
			"aliases": [
				"Greenbug"
			],
			"source_name": "MISPGALAXY:CHRYSENE",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "e5ff825b-0456-4013-b90a-971b93def74a",
			"created_at": "2022-10-25T15:50:23.824058Z",
			"updated_at": "2026-04-10T02:00:05.377261Z",
			"deleted_at": null,
			"main_name": "APT33",
			"aliases": [
				"APT33",
				"HOLMIUM",
				"Elfin",
				"Peach Sandstorm"
			],
			"source_name": "MITRE:APT33",
			"tools": [
				"PowerSploit",
				"AutoIt backdoor",
				"PoshC2",
				"Mimikatz",
				"NanoCore",
				"DEADWOOD",
				"StoneDrill",
				"POWERTON",
				"LaZagne",
				"TURNEDUP",
				"NETWIRE",
				"Pupy",
				"ftp"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "6e3ba400-aee3-4ef3-8fbc-ec07fdbee46c",
			"created_at": "2025-08-07T02:03:24.731268Z",
			"updated_at": "2026-04-10T02:00:03.651425Z",
			"deleted_at": null,
			"main_name": "COBALT FOXGLOVE",
			"aliases": [
				"Fox Kitten ",
				"Lemon Sandstorm ",
				"Parisite ",
				"Pioneer Kitten ",
				"RUBIDIUM ",
				"UNC757 "
			],
			"source_name": "Secureworks:COBALT FOXGLOVE",
			"tools": [
				"Chisel",
				"FRP (Fast Reverse Proxy)",
				"Mimikatz",
				"Ngrok",
				"POWSSHNET",
				"STSRCheck",
				"Servo",
				"n3tw0rm ransomware",
				"pay2key ransomware"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "c786e025-c267-40bd-9491-328da70811a5",
			"created_at": "2025-08-07T02:03:24.736817Z",
			"updated_at": "2026-04-10T02:00:03.752071Z",
			"deleted_at": null,
			"main_name": "COBALT GYPSY",
			"aliases": [
				"APT34 ",
				"CHRYSENE ",
				"Crambus ",
				"EUROPIUM ",
				"Hazel Sandstorm ",
				"Helix Kitten ",
				"ITG13 ",
				"OilRig ",
				"Yellow Maero "
			],
			"source_name": "Secureworks:COBALT GYPSY",
			"tools": [
				"Glimpse",
				"Helminth",
				"Jason",
				"MacDownloader",
				"PoisonFrog",
				"RGDoor",
				"ThreeDollars",
				"TinyZbot",
				"Toxocara",
				"Trichuris",
				"TwoFace"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "b23e717c-0b27-47e0-b3c8-4defe6dd857f",
			"created_at": "2023-01-06T13:46:38.367369Z",
			"updated_at": "2026-04-10T02:00:02.945356Z",
			"deleted_at": null,
			"main_name": "APT33",
			"aliases": [
				"Elfin",
				"MAGNALLIUM",
				"HOLMIUM",
				"COBALT TRINITY",
				"G0064",
				"ATK35",
				"Peach Sandstorm",
				"TA451",
				"APT 33",
				"Refined Kitten"
			],
			"source_name": "MISPGALAXY:APT33",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "67709937-2186-4a32-b64c-a5693d40ac77",
			"created_at": "2023-01-06T13:46:38.495593Z",
			"updated_at": "2026-04-10T02:00:02.999196Z",
			"deleted_at": null,
			"main_name": "OilRig",
			"aliases": [
				"Crambus",
				"Helix Kitten",
				"APT34",
				"IRN2",
				"ATK40",
				"G0049",
				"EUROPIUM",
				"TA452",
				"Twisted Kitten",
				"Cobalt Gypsy",
				"APT 34",
				"Evasive Serpens",
				"Hazel Sandstorm",
				"Earth Simnavaz"
			],
			"source_name": "MISPGALAXY:OilRig",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "871acc40-6cbf-4c81-8b40-7f783616afbc",
			"created_at": "2023-01-06T13:46:39.156237Z",
			"updated_at": "2026-04-10T02:00:03.232876Z",
			"deleted_at": null,
			"main_name": "Fox Kitten",
			"aliases": [
				"UNC757",
				"Lemon Sandstorm",
				"RUBIDIUM",
				"PIONEER KITTEN",
				"PARISITE"
			],
			"source_name": "MISPGALAXY:Fox Kitten",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "d070e12b-e1ce-4d8d-b5e3-bc71960cc0cb",
			"created_at": "2022-10-25T15:50:23.676504Z",
			"updated_at": "2026-04-10T02:00:05.260839Z",
			"deleted_at": null,
			"main_name": "Fox Kitten",
			"aliases": [
				"Fox Kitten",
				"UNC757",
				"Parisite",
				"Pioneer Kitten",
				"RUBIDIUM",
				"Lemon Sandstorm"
			],
			"source_name": "MITRE:Fox Kitten",
			"tools": [
				"China Chopper",
				"Pay2Key",
				"ngrok",
				"PsExec"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "b938e2e3-3d1b-4b35-a031-ddf25b912557",
			"created_at": "2022-10-25T16:07:23.35582Z",
			"updated_at": "2026-04-10T02:00:04.55531Z",
			"deleted_at": null,
			"main_name": "APT 33",
			"aliases": [
				"APT 33",
				"ATK 35",
				"Cobalt Trinity",
				"Curious Serpens",
				"Elfin",
				"G0064",
				"Holmium",
				"Magnallium",
				"Peach Sandstorm",
				"Refined Kitten",
				"TA451",
				"Yellow Orc"
			],
			"source_name": "ETDA:APT 33",
			"tools": [
				"Atros2.CKPN",
				"AutoIt backdoor",
				"Breut",
				"CinaRAT",
				"DROPSHOT",
				"DarkComet",
				"DarkKomet",
				"DistTrack",
				"EmPyre",
				"EmpireProject",
				"FYNLOS",
				"FalseFont",
				"Filerase",
				"Fynloski",
				"JuicyPotato",
				"Krademok",
				"LOLBAS",
				"LOLBins",
				"LaZagne",
				"Living off the Land",
				"Mimikatz",
				"Nancrat",
				"NanoCore",
				"NanoCore RAT",
				"NetWeird",
				"NetWire",
				"NetWire RAT",
				"NetWire RC",
				"NetWired RC",
				"Notestuk",
				"POWERTON",
				"PoshC2",
				"PowerBand",
				"PowerShell Empire",
				"PowerSploit",
				"PsList",
				"Pupy",
				"PupyRAT",
				"Quasar RAT",
				"QuasarRAT",
				"Recam",
				"Remcos",
				"RemcosRAT",
				"Remvio",
				"SHAPESHIFT",
				"Shamoon",
				"Socmer",
				"StoneDrill",
				"TURNEDUP",
				"Tickler",
				"Yggdrasil",
				"Zurten",
				"klovbot",
				"pupy"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "b6436f7b-6012-4969-aed1-d440e2e8b238",
			"created_at": "2022-10-25T16:07:23.91517Z",
			"updated_at": "2026-04-10T02:00:04.788408Z",
			"deleted_at": null,
			"main_name": "OilRig",
			"aliases": [
				"APT 34",
				"ATK 40",
				"Chrysene",
				"Cobalt Gypsy",
				"Crambus",
				"DEV-0861",
				"EUROPIUM",
				"Earth Simnavaz",
				"Evasive Serpens",
				"G0049",
				"Hazel Sandstorm",
				"Helix Kitten",
				"IRN2",
				"ITG13",
				"Scarred Manticore",
				"Storm-0861",
				"TA452",
				"Twisted Kitten",
				"UNC1860",
				"Yellow Maero"
			],
			"source_name": "ETDA:OilRig",
			"tools": [
				"AMATIAS",
				"Agent Drable",
				"Agent Injector",
				"AgentDrable",
				"Alma Communicator",
				"BONDUPDATER",
				"CACTUSPIPE",
				"Clayslide",
				"CypherRat",
				"DNSExfitrator",
				"DNSpionage",
				"DROPSHOT",
				"DistTrack",
				"DropperBackdoor",
				"Fox Panel",
				"GREYSTUFF",
				"GoogleDrive RAT",
				"HighShell",
				"HyperShell",
				"ISMAgent",
				"ISMDoor",
				"ISMInjector",
				"Jason",
				"Karkoff",
				"LIONTAIL",
				"LOLBAS",
				"LOLBins",
				"LONGWATCH",
				"LaZagne",
				"Living off the Land",
				"MailDropper",
				"Mimikatz",
				"MrPerfectInstaller",
				"OILYFACE",
				"OopsIE",
				"POWBAT",
				"POWRUNER",
				"Plink",
				"Poison Frog",
				"PowerExchange",
				"PsList",
				"PuTTY Link",
				"QUADAGENT",
				"RDAT",
				"RGDoor",
				"SEASHARPEE",
				"Saitama",
				"Saitama Backdoor",
				"Shamoon",
				"SideTwist",
				"SpyNote",
				"SpyNote RAT",
				"StoneDrill",
				"TONEDEAF",
				"TONEDEAF 2.0",
				"ThreeDollars",
				"TwoFace",
				"VALUEVAULT",
				"Webmask",
				"WinRAR",
				"ZEROCLEAR",
				"ZeroCleare",
				"certutil",
				"certutil.exe"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775439074,
	"ts_updated_at": 1775826781,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/326af32d3077ee99069824100328d5110e0a724e.pdf",
		"text": "https://archive.orkl.eu/326af32d3077ee99069824100328d5110e0a724e.txt",
		"img": "https://archive.orkl.eu/326af32d3077ee99069824100328d5110e0a724e.jpg"
	}
}