Activity: defense and aerospace sectors, also interested in targeting entities in the oil/gas industry.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | SaffronRose |
| OSINT | Saffron Rose |
| OSINT | AjaxSecurityTeam |
| OSINT | Ajax Security Team |
| OSINT | Group 26 |
| OSINT | Sayad |
| OSINT | Operation Woolen-Goldfish |
| OSINT | AjaxTM |
| OSINT | Rocket Kitten |
| OSINT | Operation Saffron Rose |
Sectors: Military, Civil society, Aerospace, Defense, Gas, Oil
Victim countries: United States, Iranian internet activists
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names Flying Kitten, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Flying Kitten. Each row shows why it was linked and where it came from.
| Type | Indicator | Linked by | Seen | Source |
|---|---|---|---|---|
| domain | account-signin-myaccount-users.ga | OTX pulse "Flying Kitten to Rocket Kitten" | 2017-12-05 | AlienVault OTX |
| domain | drive-sigin-permissionsneed.ml | OTX pulse "Flying Kitten to Rocket Kitten" | 2017-12-05 | AlienVault OTX |
| domain | dropebox.co | OTX pulse "Flying Kitten to Rocket Kitten" | 2017-12-05 | AlienVault OTX |
| domain | hangouting-signin-to-chat.ga | OTX pulse "Flying Kitten to Rocket Kitten" | 2017-12-05 | AlienVault OTX |
| domain | mg5-myfile-available-signin.ga | OTX pulse "Flying Kitten to Rocket Kitten" | 2017-12-05 | AlienVault OTX |
| domain | security-supportteams-mail-change.ga | OTX pulse "Flying Kitten to Rocket Kitten" | 2017-12-05 | AlienVault OTX |
| domain | singin-your-drive.ga | OTX pulse "Flying Kitten to Rocket Kitten" | 2017-12-05 | AlienVault OTX |
| domain | verify-account-for-secure.ga | OTX pulse "Flying Kitten to Rocket Kitten" | 2017-12-05 | AlienVault OTX |
| domain | your-file-drive-permission-for-download.cf | OTX pulse "Flying Kitten to Rocket Kitten" | 2017-12-05 | AlienVault OTX |
| hostname | aol.userfile-need-permission-download-signin.com | OTX pulse "Flying Kitten to Rocket Kitten" | 2017-12-05 | AlienVault OTX |
| hostname | changepassword.userfile-need-permission-download-signin.com | OTX pulse "Flying Kitten to Rocket Kitten" | 2017-12-05 | AlienVault OTX |
| hostname | cox.userfile-need-permission-download-signin.com | OTX pulse "Flying Kitten to Rocket Kitten" | 2017-12-05 | AlienVault OTX |
| hostname | drive.signin-account-privacymail.com | OTX pulse "Flying Kitten to Rocket Kitten" | 2017-12-05 | AlienVault OTX |
| hostname | durham-ac-uk.userfile-need-permission-download-signin.com | OTX pulse "Flying Kitten to Rocket Kitten" | 2017-12-05 | AlienVault OTX |
| hostname | network.us14-userfile-permission-account-signin.com | OTX pulse "Flying Kitten to Rocket Kitten" | 2017-12-05 | AlienVault OTX |
| hostname | onedrive.signin-useraccount-mail.com | OTX pulse "Flying Kitten to Rocket Kitten" | 2017-12-05 | AlienVault OTX |
| hostname | verify-google-password.userfile-need-permission-download-signin.com | OTX pulse "Flying Kitten to Rocket Kitten" | 2017-12-05 | AlienVault OTX |
| hostname | www.drive-useraccount-signin-mail.ga | OTX pulse "Flying Kitten to Rocket Kitten" | 2017-12-05 | AlienVault OTX |
| hostname | yahoo-drive.signin-useraccount-mail.com | OTX pulse "Flying Kitten to Rocket Kitten" | 2017-12-05 | AlienVault OTX |
| hostname | yahoodrive.signin-account-privacymail.com | OTX pulse "Flying Kitten to Rocket Kitten" | 2017-12-05 | AlienVault OTX |
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.