RUBIDIUM

RUBIDIUM is Microsoft's legacy designation for the Iranian IRGC-linked threat cluster known as Pioneer Kitten, before the group was renamed Lemon Sandstorm as part of Microsoft's 2023 threat actor naming taxonomy update. Active since at least 2023 in Microsoft's tracking, RUBIDIUM conducted network intrusion and access-brokering operations exploiting VPN vulnerabilities, consistent with the broader Pioneer Kitten cluster's dual espionage and ransomware-enablement mission. The designation is now retired, with all subsequent reporting consolidated under the Lemon Sandstorm name. Operationally, RUBIDIUM activity overlaps with ClearSky's Fox Kitten and CrowdStrike's Parisite tracking of the same Iranian IRGC-attributed actor.