Tracer Kitten

Tracer Kitten is CrowdStrike's designation for an Iran-based cyber espionage actor active since at least 2016, with a suspected nexus to the Iranian government. The group likely fulfills Iranian intelligence requirements related to telecommunications entities in the Middle East and beyond. In April 2020, CrowdStrike Falcon OverWatch discovered Tracer Kitten conducting malicious interactive activity against multiple hosts at a telecommunications company in the Europe, Middle East and Africa (EMEA) region, operating under valid user credentials to evade detection. The group's activity is characterized by credential abuse, lateral movement using legitimate access tools, and focus on telecommunications intelligence — sectors of consistent strategic interest to Iranian state actors seeking to monitor regional communications infrastructure. Tracer Kitten's targeting profile and operational techniques align broadly with other IRGC-linked actors focused on telecommunications and critical communications infrastructure in the region.