Nemesis Kitten Cluster

Nemesis Kitten is an Iranian threat cluster linked to the IRGC and active since at least 2020, known for conducting ransomware operations that blend financially motivated activity with state-directed espionage and disruption. The group is notable for operating at the intersection of Iran's national cyber objectives and opportunistic ransomware deployment, making attribution and intent particularly difficult to assess.

Targets and Goals

Nemesis Kitten has targeted organizations across the United States, Europe, Israel, and Australia, with victims spanning healthcare, government, financial services, and critical infrastructure sectors. A subgroup — tracked as DEV-0270/Storm-0270 — conducted ransomware attacks against US organizations in 2022 using BitLocker encryption to lock victim systems. Secureworks assessed that Cobalt Mirage, the primary tracking identity, pursues two distinct goals: ransomware for financial gain and targeted intrusions for intelligence collection, sometimes within the same operational infrastructure.

Tooling and Tactics

The cluster exploits internet-facing vulnerabilities — including known flaws in Fortinet, ProxyShell, and Log4Shell — for initial access. Post-compromise activity includes deployment of FRPC (Fast Reverse Proxy Client) tunnels for persistent access, use of living-off-the-land techniques, and ultimately deployment of ransomware or data theft tools. The DEV-0270/Storm-0270 subgroup specifically used Windows BitLocker Drive Encryption as a ransomware mechanism, a distinctive and low-sophistication approach that caused significant disruption.

Aliases

Nemesis Kitten is tracked as Cobalt Mirage by Secureworks, and DEV-0270/Storm-0270 by Microsoft for the ransomware-focused subgroup. All identities reflect the same Iranian IRGC-linked cluster operating a dual espionage and ransomware mission.