Fox Kitten

Fox Kitten, an Iran-based cyber espionage group active since at least 2017, has been a significant threat actor in the cybersecurity landscape. This group primarily targets VPN devices from Citrix, Fortinet, Palo Alto Networks, and Pulse Secure for initial access into networks. The FBI identified Fox Kitten, also known as Parisite group, as elite hackers for the Iranian government, and they have been detected attacking the US private and government sector since August 2020. Despite their ties to the Iranian government, it is believed that the Fox Kitten actors were likely operating without any explicit approval from their sponsors. The US Cybersecurity and Infrastructure Security Agency (CISA) warned that Fox Kitten, also known as Lemon Sandstorm, had launched ransomware attacks against various countries. Another group, Charming Kitten or APT42, targeted individuals associated with both the Democratic and Republican presidential campaigns. Once inside a network, Fox Kitten captures login credentials, deploys Web shells, creates rogue accounts, loads malware, moves laterally, and escalates privileges. They have exploited several vulnerabilities, including CVE-2019-19781 and CVE-2022-1388. Most recently, they targeted CVE-2024-24919, a now-patched zero-day bug in Check Point VPNs. Despite being based in Iran, Fox Kitten actors have engaged with other ransomware actors without disclosing their location or ties to the country. The CISA-FBI advisory identified Fox Kitten as providing operators of ransomware strains such as ALPHV (or BlackCat), Ransomhouse, and NoEscape with initial access to compromised networks in return for a percentage of any collected ransom. In 2021, Microsoft, which tracks Fox Kitten as Rubidum, identified the threat actor as one of six Iranian state-backed groups engaged in a wide range of cyber-enabled information theft, disruption, and destructive activities against US entities. In many instances, Fox Kitten gained access to a victim network via exploits that targeted vulnerabilities in an organization's Internet-facing assets.