Actors Insights|Latest update04/07/2026

Rocket Kitten

Named by CrowdStrikeSuspected state sponsor: Islamic Republic of Iran

Rocket Kitten is an Iranian cyber espionage cluster active since at least 2011, targeting Israeli defense and academic researchers, European government officials, NATO personnel, and Iranian dissidents. The group was comprehensively documented by Check Point and ClearSky in 2015, exposing its spear phishing campaigns and GHOLE/CWoolger malware toolkit. Check Point's exposure included the group's operational target database, providing rare visibility into Iranian state espionage targeting. The cluster is also tracked as TG-2889 (Trend Micro) and TEMP.Beanie (Mandiant).

First Seen:Mar 2011
Last Seen:Apr 2022
Indexed Reports:3
Public IOCs:77
Cluster: Rocket KittenMitre: Ajax Security TeamMisp: Rocket Kitten
also known as:
TEMP.Beanie (Mandiant)Operation Woolen GoldfishThamar Reservoir (ClearSky)Timberworm (Symantec)Rocket Kitten (CrowdStrike)Ajax Security Team (FireEye)AjaxTMFlying Kitten (CrowdStrike)Operation Saffron RoseG0130 (Mitre)

Targeted Regions

Afghanistan
AF
Afghanistan
Afghanistan
Jun 2014 ~ Jun 2015
Jun 2014 ~ Jun 2015
Canada
CA
Canada
Canada
Jun 2014 ~ Jun 2015
Jun 2014 ~ Jun 2015
Egypt
EG
Egypt
Egypt
Jun 2014 ~ Jun 2015
Jun 2014 ~ Jun 2015
Europe
EU
Europe
Europe
Mar 2011 ~ Mar 2015
Mar 2011 ~ Mar 2015
Mar 2011 ~ Mar 2015
Mar 2011 ~ Mar 2015
Mar 2011 ~ Mar 2015
Mar 2011 ~ Mar 2015
Mar 2011 ~ Mar 2015
Germany
DE
Germany
Germany
Mar 2011 ~ Mar 2015
Mar 2011 ~ Mar 2015
Mar 2011 ~ Mar 2015
Mar 2011 ~ Mar 2015
Mar 2011 ~ Mar 2015
Mar 2011 ~ Mar 2015
Mar 2011 ~ Mar 2015
Iran
IR
Iran
Iran
Jun 2014 ~ Jun 2015
Jun 2014 ~ Jun 2015
Iraq
IQ
Iraq
Iraq
Jun 2014 ~ Jun 2015
Jun 2014 ~ Jun 2015
Israel
IL
Israel
Israel
Mar 2011 ~ Mar 2015
Mar 2011 ~ Mar 2015
Mar 2011 ~ Mar 2015
Mar 2011 ~ Mar 2015
Mar 2011 ~ Mar 2015
Mar 2011 ~ Mar 2015
Jun 2014 ~ Jun 2015
Mar 2011 ~ Mar 2015
Jun 2014 ~ Jun 2015
Jordan
JO
Jordan
Jordan
Jun 2014 ~ Jun 2015
Jun 2014 ~ Jun 2015
Kuwait
KW
Kuwait
Kuwait
Jun 2014 ~ Jun 2015
Jun 2014 ~ Jun 2015
Middle East
ME
Middle East
Middle East
Jun 2014 ~ Jun 2015
Jun 2014 ~ Jun 2015
Morocco
MA
Morocco
Morocco
Jun 2014 ~ Jun 2015
Jun 2014 ~ Jun 2015
Pakistan
PK
Pakistan
Pakistan
Jun 2014 ~ Jun 2015
Jun 2014 ~ Jun 2015
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Jun 2014 ~ Jun 2015
Jun 2014 ~ Jun 2015
Spain
ES
Spain
Spain
Jun 2014 ~ Jun 2015
Jun 2014 ~ Jun 2015
Syria
SY
Syria
Syria
Jun 2014 ~ Jun 2015
Jun 2014 ~ Jun 2015
Turkey
TR
Turkey
Turkey
Jun 2014 ~ Jun 2015
Jun 2014 ~ Jun 2015
United Arab Emirates
AE
United Arab Emirates
United Arab Emirates
Jun 2014 ~ Jun 2015
Jun 2014 ~ Jun 2015
United Kingdom
GB
United Kingdom
United Kingdom
Jun 2014 ~ Jun 2015
Jun 2014 ~ Jun 2015
Venezuela
VE
Venezuela
Venezuela
Jun 2014 ~ Jun 2015
Jun 2014 ~ Jun 2015
Yemen
YE
Yemen
Yemen
Jun 2014 ~ Jun 2015
Jun 2014 ~ Jun 2015
Jan 2011May 2026

Targeted Sectors

Government Agencies and ServicesUniversityDefenseHuman RightsJournalistsResearchers

Recent Indexed Reports

  1. Public
    The Shadow of Rocket Kitten: Exploring a Sophisticated VMware Exploit
  2. Public
    Thamar Reservoir: Iranian Cyber Campaign Targets Middle East Sectors
  3. Public
    Rocket Kitten’s Operation Woolen-GoldFish Targets Israeli and European Organizations

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.