TRACER KITTEN's Sophisticated Attack on EMEA Telecommunications Network
- Actor Motivations: Espionage,Exfiltration
- Attack Vectors: Backdoor
- Attack Complexity: Medium
- Threat Risk: High Impact/Low Probability
Threat Overview
In April 2020, Iran-based threat actor TRACER KITTEN targeted a telecommunications company in the EMEA region, leveraging valid credentials and custom backdoors for persistent access and C2 communications. The adversary employed SSH tunnels, masqueraded tools, and rogue Windows services to evade detection. Credential theft attempts involved LSASS dumps via comsvcs.dll and a modified Mimikatz. Reconnaissance was extensive, using native Windows tools to enumerate users, groups, and services, followed by a pass-the-hash attempt with Invoke-TheHash. Early detection allowed defenders to mitigate potential data exfiltration.
Detected Targets
| Type | Description | Confidence |
|---|---|---|
| Sector | Telecommunication | Verified |
| Region | Middle East Countries | Verified |
| Region | European Countries | Verified |
About Affiliation
Tracer Kitten
Tracer Kitten is CrowdStrike's designation for an Iran-based cyber espionage actor active since at least 2016, with a suspected nexus to the Iranian government. The group likely fulfills Iranian intelligence requirements related to telecommunications entities in the Middle East and beyond. In April 2020, CrowdStrike Falcon OverWatch discovered Tracer Kitten conducting malicious interactive activity against multiple hosts at a telecommunications company in the Europe, Middle East and Africa (EMEA) region, operating under valid user credentials to evade detection. The group's activity is characterized by credential abuse, lateral movement using legitimate access tools, and focus on telecommunications intelligence — sectors of consistent strategic interest to Iranian state actors seeking to monitor regional communications infrastructure. Tracer Kitten's targeting profile and operational techniques align broadly with other IRGC-linked actors focused on telecommunications and critical communications infrastructure in the region.
View Tracer Kitten's Insights