Actors Insights|Latest update04/07/2026

Fox Kitten

Named by ClearSkySuspected state sponsor: Islamic Republic of Iran

Fox Kitten is ClearSky Cyber Security's designation for the Iranian IRGC-linked threat cluster known as Pioneer Kitten. ClearSky documented Fox Kitten as one of the first Iranian groups to systematically exploit VPN vulnerabilities at scale — including Pulse Secure CVE-2019-11510, Fortinet CVE-2018-13379, and Citrix CVE-2019-19781 — to establish persistent access to target networks in Israel and the broader Middle East. ClearSky's 2020 report on Fox Kitten provided the most comprehensive early documentation of the group's VPN exploitation methodology and its downstream use for both espionage and access brokering.

First Seen:Jan 2017
Last Seen:Jul 2025
Indexed Reports:2
Public IOCs:62
Cluster: Pioneer KittenMitre: Fox KittenMisp: Fox Kitten
also known as:
Pioneer Kitten (CrowdStrike)Parisite (Dragos)UNC757 (Mandiant)Lemon Sandstorm (Microsoft)RUBIDIUM (Microsoft)Fox Kitten (ClearSky)G0117 (Mitre)

Targeted Regions

Australia
AU
Australia
Australia
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Austria
AT
Austria
Austria
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Finland
FI
Finland
Finland
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
France
FR
France
France
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Germany
DE
Germany
Germany
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Hungary
HU
Hungary
Hungary
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Israel
IL
Israel
Israel
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Italy
IT
Italy
Italy
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Kuwait
KW
Kuwait
Kuwait
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Lebanon
LB
Lebanon
Lebanon
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Poland
PL
Poland
Poland
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
United Arab Emirates
AE
United Arab Emirates
United Arab Emirates
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
United States
US
United States
United States
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jan 2017Aug 2026

Targeted Sectors

DefenseGovernment Agencies and ServicesInformation TechnologyAerospaceOil and GasTelecommunicationUtilities

Recent Indexed Reports

  1. Public
    Fox Kitten-Linked Ransomware Operation Hits $4M in Geopolitical Cyber Campaign
  2. Public
    Fox Kitten Campaign: Iranian APTs Target Global Infrastructure via VPN Exploits

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.