{
	"id": "1cad8324-5e31-4772-a731-6e8e148ffe0b",
	"created_at": "2026-04-06T00:12:37.498601Z",
	"updated_at": "2026-04-10T03:37:55.892382Z",
	"deleted_at": null,
	"sha1_hash": "7f3493e264e615f521bd706aa7e9e57c57396119",
	"title": "Flying Kitten, Ajax Security Team",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 58879,
	"plain_text": "Flying Kitten, Ajax Security Team\nArchived: 2026-04-05 12:59:32 UTC\nHome \u003e List all groups \u003e Flying Kitten, Ajax Security Team\n APT group: Flying Kitten, Ajax Security Team\nNames\nFlying Kitten (CrowdStrike)\nAjax Security Team (FireEye)\nGroup 26 (Talos)\nG0130 (MITRE)\nCountry Iran\nSponsor State-sponsored\nMotivation Information theft and espionage\nFirst seen 2010\nDescription\n(FireEye) Members of this group have accounts on popular Iranian hacker forums\nsuch as ashiyane[.]org and shabgard[.]org, and they have engaged in website\ndefacements under the group name “AjaxTM” since 2010. By 2014, the Ajax\nSecurity Team had transitioned from performing defacements (their last defacement\nwas in December 2013) to malware-based espionage, using a methodology\nconsistent with other advanced persistent threat actors in this region.\n(Crowdstrike) CrowdStrike Intelligence has also been tracking and reporting\ninternally on this threat group since mid-January 2014 under the name FLYING\nKITTEN, and since that time has seen targeting of multiple U.S.-based defense\ncontractors as well as political dissidents.\nObserved\nSectors: Defense and dissidents.\nCountries: USA.\nTools used Stealer.\nOperations performed 2013\nOperation “Saffron Rose”\nInformation\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=9d17cae3-0777-428b-b9b7-fcbdf52af5ba\nPage 1 of 2\n\nMITRE ATT\u0026CK Last change to this card: 16 August 2025\nDownload this actor card in PDF or JSON format\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=9d17cae3-0777-428b-b9b7-fcbdf52af5ba\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=9d17cae3-0777-428b-b9b7-fcbdf52af5ba\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=9d17cae3-0777-428b-b9b7-fcbdf52af5ba"
	],
	"report_names": [
		"showcard.cgi?u=9d17cae3-0777-428b-b9b7-fcbdf52af5ba"
	],
	"threat_actors": [
		{
			"id": "8e1bae2f-2a21-4ba8-a6f1-42155f96aec8",
			"created_at": "2022-10-25T16:07:23.645758Z",
			"updated_at": "2026-04-10T02:00:04.700158Z",
			"deleted_at": null,
			"main_name": "Flying Kitten",
			"aliases": [
				"Ajax Security Team",
				"Flying Kitten",
				"G0130",
				"Group 26",
				"Operation Saffron Rose"
			],
			"source_name": "ETDA:Flying Kitten",
			"tools": [
				"Stealer"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "f4d7cba1-dbdd-42a9-88c5-4d0c81659ee0",
			"created_at": "2023-01-06T13:46:38.357581Z",
			"updated_at": "2026-04-10T02:00:02.941254Z",
			"deleted_at": null,
			"main_name": "Flying Kitten",
			"aliases": [
				"Saffron Rose",
				"AjaxSecurityTeam",
				"Ajax Security Team",
				"Group 26",
				"Sayad",
				"SaffronRose"
			],
			"source_name": "MISPGALAXY:Flying Kitten",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "8faa11f5-2a14-479c-9ea8-3779e6de9749",
			"created_at": "2022-10-25T15:50:23.814205Z",
			"updated_at": "2026-04-10T02:00:05.308465Z",
			"deleted_at": null,
			"main_name": "Ajax Security Team",
			"aliases": [
				"Ajax Security Team",
				"Operation Woolen-Goldfish",
				"AjaxTM",
				"Rocket Kitten",
				"Flying Kitten",
				"Operation Saffron Rose"
			],
			"source_name": "MITRE:Ajax Security Team",
			"tools": [
				"sqlmap",
				"Havij"
			],
			"source_id": "MITRE",
			"reports": null
		}
	],
	"ts_created_at": 1775434357,
	"ts_updated_at": 1775792275,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/7f3493e264e615f521bd706aa7e9e57c57396119.pdf",
		"text": "https://archive.orkl.eu/7f3493e264e615f521bd706aa7e9e57c57396119.txt",
		"img": "https://archive.orkl.eu/7f3493e264e615f521bd706aa7e9e57c57396119.jpg"
	}
}