Rampant Kitten: Iranian Cyber Espionage Campaign Exposed

A long-running espionage operation targeting Iranian dissidents and minority activists abroad was uncovered. Attackers used spyware tools on both computers and phones to collect sensitive information from victims.

While not formally attributed to a specific group, evidence strongly links the operation to Iranian government-aligned actors based on language, targets, and infrastructure registration details.

The goal was surveillance—stealing private communications, passwords, and other personal documents from individuals viewed as threats to the Iranian regime.

Victims included members of opposition movements such as the Mujahedin-e Khalq, Baloch and Azerbaijani minority advocates, and political dissidents residing outside Iran.

The attackers sent malicious documents or apps disguised as legitimate content. These files deployed spyware that silently collected data and forwarded it to attacker-controlled servers.

They represent political opposition to the Iranian government and are involved in activism or resistance efforts that challenge state authority.

Avoid downloading files or apps from unofficial sources, use antivirus tools, and keep software updated. Activists should use encrypted communications and store passwords in secure environments.