Pioneer Kitten

Pioneer Kitten, also known as UNC757, Parisite, Lemon Sandstorm, and Rubidium, is a threat actor believed to be associated with the Government of Iran (GOI) and an Iranian IT company. This group has been tracked by various cybersecurity entities such as CrowdStrike Intelligence and the FBI. Investigations conducted by the FBI in August 2024 further reinforced the connection between Pioneer Kitten and the Iranian government. Pioneer Kitten's operational model is opportunistic, with the entities of most interest being those within technology, government, defense, and healthcare sectors. In 2020, the U.S. Cyber Command’s elite digital corps (CNMF) detected that Pioneer Kitten had gained access to a city's local infrastructure intended for recording the results of the 2020 elections. Following this detection, CISA contacted the impacted jurisdiction and initiated incident response measures. Meanwhile, CNMF executed cyber operations to ensure that Pioneer Kitten no longer had access to the network and could not return to the system. Pioneer Kitten's primary operational characteristic is its reliance on SSH tunneling, employing open-source tools like Ngrok and their custom tool SSHMinion for communication with implants and hands-on-keyboard activity via Remote Desktop Protocol (RDP). The group offers full domain control privileges and domain admin credentials to numerous networks worldwide. As of recent reports, Pioneer Kitten continues to target and exploit U.S. and foreign organizations across multiple sectors, leading to increased warnings from federal agencies like CISA, FBI, and the Department of Defense Cyber Crime Center (DC3).