Actors Insights|Latest update04/07/2026

Pioneer Kitten

Named by CrowdStrikeSuspected state sponsor: Islamic Republic of Iran

Pioneer Kitten is an IRGC-linked Iranian threat cluster active since at least 2017, known for rapidly exploiting VPN and network appliance vulnerabilities — including Pulse Secure, Fortinet, Citrix, and F5 — to gain widespread network access. The group operates a dual model: conducting state-directed espionage and selling network access to ransomware affiliates including ALPHV/BlackCat. The FBI and CISA formally attributed Pioneer Kitten to an Iranian government-linked entity in 2024. The cluster is tracked as Fox Kitten (ClearSky), Parisite (CrowdStrike), UNC757 (Mandiant), and Lemon Sandstorm (Microsoft).

First Seen:Jan 2017
Last Seen:Aug 2024
Indexed Reports:3
Public IOCs:70
Cluster: Pioneer KittenMitre: Fox KittenMisp: Fox Kitten
also known as:
Pioneer Kitten (CrowdStrike)Parisite (Dragos)UNC757 (Mandiant)Lemon Sandstorm (Microsoft)RUBIDIUM (Microsoft)Fox Kitten (ClearSky)G0117 (Mitre)

Targeted Regions

Azerbaijan
AZ
Azerbaijan
Azerbaijan
Sep 2023 ~ Aug 2024
Sep 2023 ~ Aug 2024
Sep 2023 ~ Aug 2024
Sep 2023 ~ Aug 2024
Israel
IL
Israel
Israel
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Middle East
ME
Middle East
Middle East
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
United Arab Emirates
AE
United Arab Emirates
United Arab Emirates
Sep 2023 ~ Aug 2024
Sep 2023 ~ Aug 2024
Sep 2023 ~ Aug 2024
Sep 2023 ~ Aug 2024
United States
US
United States
United States
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2019 ~ Sep 2020
Jan 2017 ~ Aug 2020
Jan 2019 ~ Sep 2020
Jan 2017 ~ Aug 2020
Jan 2019 ~ Sep 2020
Jan 2017 ~ Aug 2020
Jan 2019 ~ Sep 2020
Jan 2017 ~ Aug 2020
Jan 2019 ~ Sep 2020
Sep 2023 ~ Aug 2024
Sep 2023 ~ Aug 2024
Sep 2023 ~ Aug 2024
Sep 2023 ~ Aug 2024
Jan 2017Aug 2026

Targeted Sectors

FinancialGovernment Agencies and ServicesDefenseEducationHealthcareInformation TechnologyInsuranceConsultingManufacturingRetailAerospaceMediaJournalistsMedical

Recent Indexed Reports

  1. Public
    Iran-Based Hackers Target U.S. Sectors, Collaborate with Ransomware Affiliates
  2. Public
    Pioneer Kitten's Multi-Sector Cyber Offensive in the United States
  3. Public
    PIONEER KITTEN: Exploiting VPN Vulnerabilities to Target Sensitive Sectors

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.