Imperial Kitten

Threat Actor updated 5 months ago (2024-05-04T19:33:18.741Z)
Download STIX
Preview STIX
Imperial Kitten, also known as Tortoiseshell and UNC1549, is a significant threat actor identified by cybersecurity firms CrowdStrike and Mandiant. The group has been associated with various malicious activities, including the distribution of malware through SWC, and the use of IMAPLoader and other related malware families. CrowdStrike Intelligence attributes these activities to Imperial Kitten, having analyzed several malware samples associated with the group's operations. This group, which is suspected to have ties to Iran, is known for its focus on IT service providers, but it has also expanded its tactics to include watering-hole attacks and spear phishing. The group has demonstrated sophisticated social engineering techniques, such as masquerading as part of the "Bring Them Home Now" movement—an Israeli-led effort calling for the return of hostages kidnapped by Hamas. Furthermore, they've spoofed major brands like Boeing and DJI in fake job offers meant to redirect targets to websites that enable backdoor deployment and credential exfiltration. Notably, the infrastructure described by Mandiant overlaps with hacking groups dubbed Tortoiseshell and Imperial Kitten. Imperial Kitten has been conducting cyberespionage operations using custom and off-the-shelf malware, as noted by PwC. It is one among several national threat actors, including APT 28 (Russia), Kimusky (North Korea), and Aquatic Panda and Maverick Panda (China), observed to be benefitting from a variety of OpenAI capabilities. These include open source research, identifying potential targets, code creation and resolving coding errors, vulnerability research, and translating foreign technical papers. The group is believed to be linked to the activities of the Cotton Sandstorm and Crimson Sandstorm threat actors, highlighting the complex and interconnected nature of modern cyber threats.
Description last updated: 2024-05-04T17:31:48.500Z
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.
Alias DescriptionVotes
Yellow Liderc is a possible alias for Imperial Kitten. Yellow Liderc, also known as Imperial Kitten, Tortoiseshell, TA456, and Crimson Sandstorm, is a threat actor with malicious intent. This group has been active since 2022, engaging in cyber espionage against maritime, shipping, and logistics companies primarily in the Mediterranean region. Their meth
2
Unc1549 is a possible alias for Imperial Kitten. UNC1549, also known as Smoke Sandstorm and Tortoiseshell, is a suspected Iranian threat actor targeting the aerospace and defense sectors in the Middle East, specifically Israel and the United Arab Emirates. The group's activities have been discovered and tracked by Google Cloud’s Mandiant, who have
2
Tortoiseshell is a possible alias for Imperial Kitten. Tortoiseshell is a prominent threat actor associated with multiple Iranian Advanced Persistent Threat (APT) groups, including MASN. It has been linked to a multi-year cyberattack campaign that targeted over a dozen US companies and government entities, including the Department of the Treasury. The c
2
Crimson Sandstorm is a possible alias for Imperial Kitten. Crimson Sandstorm, an Advanced Persistent Threat (APT) group linked to Iran, has been identified as a significant threat actor in the cybersecurity landscape. This entity, potentially connected to the Islamic Revolutionary Guard Corps and active since at least 2017, targets victims across diverse se
2
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Phishing
Malware
Crowdstrike
Lateral Move...
State Sponso...
Espionage
Apt
Exploit
Rat
Discord
Google
Iran
Israeli
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Associated Threat Actors
To see the evidence that has resulted in these threatActor associations, create a free account
Alias DescriptionAssociation TypeVotes
The threatActor Tortoiseshell Group is associated with Imperial Kitten. Unspecified
2
Source Document References
Information about the Imperial Kitten Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
PreviewSource LinkCreatedAtTitle
CERT-EU
7 months ago
CERT-EU
7 months ago
CERT-EU
7 months ago
CERT-EU
7 months ago
BankInfoSecurity
7 months ago
DARKReading
7 months ago
CERT-EU
7 months ago
CERT-EU
8 months ago
DARKReading
8 months ago
CERT-EU
10 months ago
CrowdStrike
10 months ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
DARKReading
a year ago
BankInfoSecurity
a year ago
InfoSecurity-magazine
a year ago