Iranian FLYING KITTEN Targets U.S. Defense and Dissidents

FLYING KITTEN — also known as Ajax Security Team — is an Iranian threat group that CrowdStrike tracked from January 2014. The group combined two attack methods: first stealing credentials through fake login pages, then delivering Stealer malware to the same victims disguised as a "Browser Patch." Targets included US defense contractors and political dissidents. The campaign was publicly disclosed simultaneously by CrowdStrike and FireEye (who called it Operation Saffron Rose) in May 2014.

FLYING KITTEN is the CrowdStrike name for the Ajax Security Team, an Iran-based hacking group. Attribution was confirmed by an operational security mistake: the group initially registered its malicious domains under the Gmail address keyvan.ajaxtm@gmail.com, which directly links back to the Ajax Security Team. The group later updated domain registrations to a cover email (info@usa.gov.us) in an attempt to obscure their identity, but historical WHOIS records preserved the original association.

FLYING KITTEN pursued two parallel goals: credential theft and malware-based espionage. Stolen credentials gave the attackers access to victims' corporate accounts and internal systems. The Stealer malware then collected and exfiltrated data from compromised machines to an FTP server controlled by the attackers. Together, these two methods gave FLYING KITTEN both account access and direct file exfiltration from targeted defense contractors and political dissidents.

The confirmed targets were US-based defense contractors and political dissidents. The group also registered infrastructure suggesting potential broader targeting through a fake recruiting website (parmanpower[.]com) posing as a company in Erbil, Iraq, which could have been used to target individuals across many sectors. An earlier domain (aeroconf2014[.]org) impersonated the IEEE Aerospace Conference, indicating the aerospace and defense verticals were a primary focus in early 2014.

US defense contractors working in aerospace and defense hold sensitive information about weapons programs, military technology, and defense contracts that is directly valuable to Iranian intelligence. Political dissidents are targeted because the Iranian government monitors and seeks to suppress opposition figures living abroad. Both groups represent high-priority intelligence collection targets for Iran's state security apparatus.

FLYING KITTEN combined two techniques in sequence. First, the group registered domains that closely mimicked the names of target organizations or industry events — for example, a fake IEEE Aerospace Conference website — and hosted convincing fake login pages on those domains. When victims entered their real credentials, the attacker captured them. Victims were then immediately redirected to a page prompting them to download a "Browser Patch" or security update — which was actually the Stealer malware. Once installed, Stealer collected data from the compromised machine and transmitted it to an attacker-controlled FTP server. The entire chain — from credential theft to malware delivery — happened in a single victim session.

What made this campaign notable was the combination of credential theft and immediate malware delivery in a single session — which FireEye's concurrent reporting had treated as two separate tactics. FLYING KITTEN chained them together, maximizing the damage from a single victim interaction. The group's operational security failure — using a traceable Gmail address for domain registration — also provides a clear lesson: even small mistakes in infrastructure setup can expose the identity of a threat actor to investigators.