Ferocious Kitten

Ferocious Kitten is an Iranian-linked cyber espionage group active since at least 2015, first documented by Kaspersky in June 2021 after six years of undetected operation. Unlike most Iranian APTs targeting foreign governments, Ferocious Kitten focuses exclusively on Persian-speaking individuals inside Iran — including dissidents, activists, and opposition-linked targets — consistent with a domestic surveillance mission. The group delivers its custom MarkiRAT implant via spear phishing with politically themed decoy documents depicting anti-regime protests, along with backdoored versions of tools popular among Iranians such as the Psiphon VPN app. MarkiRAT provides keylogging, clipboard capture, screenshot collection, file upload and download, and arbitrary command execution over HTTP and HTTPS command and control. The group also developed specialized MarkiRAT variants that hijack Telegram and Chrome execution by replacing application shortcuts, enabling persistent access alongside legitimate apps. TTPs overlap with those of Domestic Kitten and Rampant Kitten, suggesting coordination within Iran's domestic surveillance apparatus.