Flying Kitten Cluster

Flying Kitten is an Iranian hacktivist-turned-espionage threat cluster active since at least 2010, originally known as the Ajax Security Team. The group began as a defacement-focused hacktivist collective active on Iranian hacking forums before transitioning to targeted espionage operations against defense and government targets, primarily in the United States and Israel.

Targets and Goals

Flying Kitten targeted US defense contractors, aerospace companies, and energy sector organizations, as well as Iranian dissidents who had evaded government surveillance. FireEye documented a 2014 campaign in which the group distributed fake anti-censorship tools — particularly a trojanized version of Psiphon — to Iranian dissidents to install malware on their devices, blending domestic surveillance with foreign espionage objectives.

Tooling and Tactics

The group used custom malware including the Stealer and Flawedammyy tools, delivered through spear phishing and fake software packages. The trojanized Psiphon campaign demonstrated the group's willingness to target both Iranian citizens seeking circumvention tools and foreign defense targets simultaneously. Ajax Security Team members were documented on Iranian hacker forums under handles known to Iranian cybersecurity researchers, providing an unusually clear link between the forum hacktivist community and state-directed operations.

Current Status

Flying Kitten / Ajax Security Team activity largely ceased in public reporting after 2019. The group is considered dormant, with its operators likely absorbed into broader Iranian state cyber structures.