Imperial Kitten Cluster

Imperial Kitten is an Iran-nexus threat cluster with a suspected connection to the Islamic Revolutionary Guard Corps (IRGC), active since at least 2017. Named and tracked by CrowdStrike, the group conducts targeted espionage and strategic web compromise (SWC) operations against organizations across the transportation, logistics, maritime, defense, technology, and energy sectors. It has a particular focus on Israeli organizations and Middle Eastern targets.

Targets and Goals

Imperial Kitten's targeting aligns with IRGC strategic intelligence requirements. The group has consistently targeted Israeli maritime and transportation companies, as well as defense contractors and technology firms across the Middle East and beyond. Strategic web compromise operations — in which the group compromises legitimate Israeli websites to profile and redirect visitors — demonstrate a focus on supply chain access and sector-wide intelligence collection rather than individual-target operations.

Tooling and Tactics

The group uses multiple initial access vectors including SQL injection, stolen VPN credentials, one-day exploits, and job-recruitment-themed phishing using macro-enabled Excel documents. A distinctive characteristic is its use of email-based command and control — particularly via IMAP protocols — documented in malware families including IMAPLoader, StandardKeyboard, and the earlier Liderc implant. Post-compromise tooling includes Python reverse shells and Discord-based C2 mechanisms. Lateral movement relies on PAExec, credential theft tools, and public scanning utilities.

Aliases

Imperial Kitten is tracked as Tortoiseshell (Symantec/Broadcom), TA456 and TA455 (Proofpoint), Crimson Sandstorm (Microsoft), Curium (Cisco Talos), ITG17 (IBM), Smoke Sandstorm (Microsoft recent activity), and Yellow Liderc (PWC) — all referring to overlapping activity within the same Iranian IRGC-linked cluster.