Actors Insights|Latest update04/07/2026

Pioneer Kitten Cluster

Suspected state sponsor: Islamic Republic of Iran

Pioneer Kitten is an Iranian state-linked threat cluster active since at least 2017, assessed to have ties to the Islamic Revolutionary Guard Corps (IRGC). The group is distinguished by its focus on exploiting internet-facing VPN and network appliance vulnerabilities to gain initial access, and its dual operation model — conducting espionage for the Iranian state while simultaneously collaborating with ransomware affiliates for financial gain.

 

Targets and Goals

Pioneer Kitten has targeted organizations across the United States, Israel, Azerbaijan, and the UAE, with victims spanning government, defense, healthcare, financial, and technology sectors. The group is particularly aggressive in opportunistically scanning for and exploiting newly disclosed vulnerabilities in VPN products — including Pulse Secure, Fortinet FortiOS, Citrix ADC, and F5 BIG-IP — to gain widespread access. The US FBI and CISA formally attributed Pioneer Kitten to an Iranian government-linked entity in August 2024, noting the group's practice of selling network access to ransomware affiliates including ALPHV/BlackCat and Ransomhouse.

 

Tooling and Tactics

Pioneer Kitten's primary access vector is the rapid exploitation of known CVEs in VPN and remote access appliances. Post-compromise, the group uses open-source tools including Ngrok and Ligolo for tunneling and persistence, alongside custom implants. The group's collaboration with ransomware actors — selling initial access and operational support — represents an unusual intersection of state-directed espionage and cybercrime that provides Iran with both intelligence value and financial revenue.

 

Aliases

Pioneer Kitten is tracked as Fox Kitten (ClearSky), Parisite (CrowdStrike), UNC757 (Mandiant), RUBIDIUM and Lemon Sandstorm (Microsoft), and Br0k3r/xplfinder for the ransomware access-broker personas. All identities reflect the same IRGC-linked Iranian cluster.

Most Common Tactics

Targeted Regions

Australia
AU
Australia
Australia
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Austria
AT
Austria
Austria
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Azerbaijan
AZ
Azerbaijan
Azerbaijan
Sep 2023 ~ Aug 2024
Sep 2023 ~ Aug 2024
Sep 2023 ~ Aug 2024
Sep 2023 ~ Aug 2024
Finland
FI
Finland
Finland
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
France
FR
France
France
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Germany
DE
Germany
Germany
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Hungary
HU
Hungary
Hungary
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Israel
IL
Israel
Israel
Jan 2017 ~ Feb 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Aug 2020
Jun 2020 ~ Jul 2025
Jan 2017 ~ Aug 2020
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Italy
IT
Italy
Italy
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Kuwait
KW
Kuwait
Kuwait
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Lebanon
LB
Lebanon
Lebanon
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Middle East
ME
Middle East
Middle East
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Aug 2020
Poland
PL
Poland
Poland
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
United Arab Emirates
AE
United Arab Emirates
United Arab Emirates
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Feb 2020
Sep 2023 ~ Aug 2024
Sep 2023 ~ Aug 2024
Sep 2023 ~ Aug 2024
Sep 2023 ~ Aug 2024
United States
US
United States
United States
Jan 2017 ~ Feb 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Aug 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Aug 2020
Jan 2019 ~ Sep 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Aug 2020
Jan 2019 ~ Sep 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Aug 2020
Jan 2019 ~ Sep 2020
Jan 2017 ~ Feb 2020
Jan 2017 ~ Aug 2020
Jan 2019 ~ Sep 2020
Jun 2020 ~ Jul 2025
Jan 2017 ~ Aug 2020
Jan 2019 ~ Sep 2020
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Sep 2023 ~ Aug 2024
Jun 2020 ~ Jul 2025
Sep 2023 ~ Aug 2024
Jun 2020 ~ Jul 2025
Sep 2023 ~ Aug 2024
Jun 2020 ~ Jul 2025
Sep 2023 ~ Aug 2024
Jun 2020 ~ Jul 2025
Jun 2020 ~ Jul 2025
Jan 2017Aug 2026

Recent Activities

  1. Public
    Fox Kitten-Linked Ransomware Operation Hits $4M in Geopolitical Cyber Campaign
  2. Public
    Iran-Based Hackers Target U.S. Sectors, Collaborate with Ransomware Affiliates
  3. Public
    Pioneer Kitten's Multi-Sector Cyber Offensive in the United States
see more

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.