Haywire Kitten

Haywire Kitten is CrowdStrike's designation for the Iranian threat cluster known as Cotton Sandstorm, linked to the IRGC-affiliated Emennet Pasargad company. The group conducts a mix of disruptive cyberattacks and influence operations against Israeli and Western targets, particularly in the media, critical infrastructure, and government sectors. Haywire Kitten operations involve website defacements, DDoS attacks, and hack-and-leak activity amplified through social media personas and Telegram channels. CrowdStrike's tracking of this cluster aligns with Microsoft's Cotton Sandstorm designation and the US government's Emennet Pasargad attribution.