Gold Open Source
ExplorePackagesVulnerabilitiesMCP Servers
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Groups/G0117
MITRE ATT&CK Group

Fox Kitten (G0117)

UNC757ParisitePioneer KittenRUBIDIUMLemon Sandstorm
ShareXLinkedInRedditHN

[Fox Kitten](https://attack.mitre.org/groups/G0117) is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. [Fox Kitten](https://attack.mitre.org/groups/G0117) has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.(Citation: ClearkSky Fox Kitten February 2020)(Citation: CrowdStrike PIONEER KITTEN August 2020)(Citation: Dragos PARISITE )(Citation: ClearSky Pay2Kitten December 2020)

▪Techniques used (41)

T1105Ingress Tool TransferT1059Command and Scripting InterpreterT1530Data from Cloud Storage

▪Software used (5)

S0020China ChoppermalwareS0556Pay2Keymalware
G0117 on MITRE ATT&CK →
T1018Remote System Discovery
T1110Brute Force
T1210Exploitation of Remote Services
T1136.001Local Account
T1560.001Archive via Utility
T1027.010Command Obfuscation
T1005Data from Local System
T1585Establish Accounts
T1021.005VNC
T1552.001Credentials In Files
T1217Browser Information Discovery
T1059.003Windows Command Shell
T1027.013Encrypted/Encoded File
T1213.005Messaging Applications
T1021.002SMB/Windows Admin Shares
T1190Exploit Public-Facing Application
T1555.005Password Managers
T1003.003NTDS
T1087.001Local Account
T1087.002Domain Account
T1021.004SSH
T1505.003Web Shell
T1053.005Scheduled Task
T1036.004Masquerade Task or Service
T1003.001LSASS Memory
T1090Proxy
T1012Query Registry
T1572Protocol Tunneling
T1021.001Remote Desktop Protocol
T1102Web Service
T1039Data from Network Shared Drive
T1078Valid Accounts
T1046Network Service Discovery
T1546.008Accessibility Features
T1585.001Social Media Accounts
T1036.005Match Legitimate Resource Name or Location
T1059.001PowerShell
T1083File and Directory Discovery
S0508ngroktool
S0029PsExectool
S9001SystemBCmalware

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.