IranAttributedIranian governmentMixedActive 2017 – 2024Fox Kitten
Also known asPioneer Kitten · Parisite · UNC757 · Cobalt Foxglove · Rubidium · Lemon Sandstorm
Summary
Iran-based intrusion group (Pioneer Kitten, Fox Kitten, UNC757, Parisite, RUBIDIUM, Lemon Sandstorm) that the FBI assesses is associated with the Government of Iran. Since 2017 it has exploited internet-facing edge devices — Citrix NetScaler (CVE-2019-19781, CVE-2023-3519), F5 BIG-IP (CVE-2022-1388), Pulse Secure/Ivanti (CVE-2019-11510, CVE-2024-21887) and PAN-OS (CVE-2024-3400) — then installed web shells and remote-access tools to keep access. FBI/CISA/DC3 (AA24-241A, Aug 2024) report that much of its activity against US organisations is access development for ransomware affiliates (NoEscape, RansomHouse, ALPHV/BlackCat) in exchange for a share of ransoms, under the moniker Br0k3r (and 'xplfinder' from 2024); separately it conducts espionage-oriented intrusions for the Iranian government, including theft of sensitive technical data in Israel and Azerbaijan. Named victims span US schools, municipal governments, financial institutions and healthcare, plus organisations in Israel, Azerbaijan and the UAE. Later activity is assessed only: Fortinet (May 2025) described a May 2023–Feb 2025 intrusion into a Middle East critical national infrastructure entity with tradecraft overlapping this group, and Morphisec (Jul 2025) linked the relaunched Pay2Key.I2P ransomware-as-a-service to it.
Attribution
Access broker for ransomware affiliates; no service named
Named by a government: indictment, sanctions designation, joint advisory or official statement.
- CISA, FBI and DC3 (AA24-241A) (Government, 2024-08-28)
Iran-based actors connected with the Government of Iran - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Suspected nexus to the Iranian government
Campaigns 3
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Pay2Key.I2P ransomware-as-a-serviceASSESSED | 2025-02 – 2025-07 | USA, Israel, Europe | Multiple | Morphisec (2025-07-08) |
| Middle East CNI long-term intrusionASSESSED | 2023-05 – 2025-02 | Middle East | Critical Infrastructure | Fortinet FortiGuard IR (2025-05-01, full report) — Iranian state-backed group with TTP overlap to Lemon Sandstorm (high confidence on Iran; the Lemon Sandstorm link is overlap) |
| Br0k3r access brokering and ransomware-affiliate collaboration | 2017 – 2024-08 | USA, Israel, Azerbaijan, UAE | Education, Finance, Healthcare, Defense, Local Government | FBI/CISA/DC3 AA24-241A (2024-08-28) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 8
Malware and tools 2
| Name | Description | Platform |
|---|---|---|
| Pay2Key | Ransomware | Windows |
| SSHMinion | Backdoor | Linux |
Exploited vulnerabilities 7
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2024-3400 | 10 | Palo Alto PAN-OS (KEV 2024-04-12) |
| CVE-2019-11510 | 9.9 | Pulse Secure VPN (KEV 2021-11-03) |
| CVE-2019-19781 | 9.8 | Citrix NetScaler ADC/Gateway — path traversal RCE (KEV 2021-11-03) |
| CVE-2022-1388 | 9.8 | F5 BIG-IP iControl REST — authentication bypass RCE (KEV 2022-05-10) |
| CVE-2023-3519 | 9.8 | Citrix NetScaler ADC/Gateway — unauthenticated RCE (KEV 2023-07-19) |
| CVE-2024-21887 | 9.1 | Ivanti Connect Secure (KEV 2024-01-10) |
| CVE-2024-24919 | 8.6 | Check Point Security Gateways — information disclosure (KEV 2024-05-30) |
Highest CVSS first.
Infrastructure patterns
- AnyDesk as backup access; Ligolo and ngrok tunnels for outbound C2 (CISA et al., 2024)
- Pay2Key .onion leak site hosted on cloud infrastructure of an organisation it had compromised (CISA et al., 2024)
Reporting and advisories 6
- CISA
AA24-241A — Iran-based Actors Enabling Ransomware - Fortinet FortiGuard IR
Middle East CNI long-term intrusion - Morphisec
Pay2Key.I2P ransomware-as-a-service - MITRE ATT&CK
Fox Kitten (G0117) group profile - CISA and FBI
AA20-259A — Iran-Based Threat Actor Exploits VPN Vulnerabilities (Sep 2020) - ClearSky
Fox Kitten Campaign — Widespread Iranian Espionage-Offensive Campaign (Feb 2020)