Rocket Kitten Cluster

Rocket Kitten is an Iranian cyber espionage cluster active since at least 2011, primarily targeting individuals and organizations in Israel, Europe, and the United States, with a particular focus on defense and academic researchers, government officials, and journalists. The group was first comprehensively documented by Check Point Research and ClearSky in 2015 through joint reporting that exposed its extensive spear phishing campaigns and credential harvesting infrastructure.

Targets and Goals

Rocket Kitten's documented targets include Israeli defense and academic researchers, European government officials, NATO-affiliated personnel, and Iranian dissidents. The group's targeting profile reflects Iranian state intelligence priorities — particularly monitoring of individuals involved in Iran nuclear negotiations, Israeli military and academic circles, and Iranian diaspora communities. The cluster's long operational history and broad targeting suggest a sustained intelligence collection mission aligned with IRGC or MOIS objectives, though formal attribution to a specific Iranian organization has not been publicly confirmed.

Tooling and Tactics

Rocket Kitten's primary method is targeted spear phishing using personalized emails crafted to appeal to specific targets' professional interests. The group deploys a custom backdoor called GHOLE (also known as Woolen-Goldfish) and the CWoolger keylogger for post-compromise intelligence collection. Credential harvesting through fake login pages mimicking Gmail, Yahoo, and institutional email portals has been a consistent technique throughout the group's operational history. Check Point's 2015 exposure of Rocket Kitten included an unusually detailed look at the group's operational database, revealing hundreds of targets across multiple countries.

Aliases

Rocket Kitten is tracked as TG-2889 (Trend Micro) and TEMP.Beanie (Mandiant) for specific campaign activity. The cluster's early history overlaps with activity later folded into broader Iranian tracking identities by some vendors.