Fox Kitten

Fox Kitten, an Iranian-based cyber espionage group active since 2017, has been identified as a significant threat actor in the cybersecurity landscape. The group primarily gains initial access through VPN devices from Citrix, Fortinet, Palo Alto Networks, and Pulse Secure. Despite being backed by Iran, it is believed that Fox Kitten operations are often conducted without explicit approval from their government sponsors. Their activities have extended to attacking both private and government sectors in the US, as reported by the FBI in August 2020. Upon gaining access to a network, Fox Kitten employs a diverse range of techniques, including capturing login credentials, deploying Web shells, creating rogue accounts, loading malware, moving laterally, and escalating privileges. They exploit vulnerabilities such as CVE-2019-19781 and CVE-2022-1388, with barely half of all affected assets found to be remediated. More recently, they have targeted CVE-2024-24919, a patched zero-day bug in Check Point VPNs, to infiltrate victim networks. Interestingly, Fox Kitten actors have been engaging with ransomware actors, providing them with initial access to compromised networks in return for a share of any collected ransom. This activity was highlighted in a recent CISA-FBI advisory, which identified links between Fox Kitten and ransomware strains such as ALPHV (or BlackCat), Ransomhouse, and NoEscape. In 2021, Microsoft, tracking Fox Kitten under the name Rubidum, listed the group among six Iranian state-backed groups engaged in various cyber theft, disruption, and destructive activities against US entities.