Refined Kitten

Summary

IRGC-linked Iranian APT (Microsoft: Peach Sandstorm; CrowdStrike: Refined Kitten; FireEye/Mandiant: APT33; Dragos: Magnallium). Microsoft assesses that it operates on behalf of the IRGC. Mandiant (2017) reported a particular interest in aviation and in energy organisations tied to petrochemical production, headquartered in the US, Saudi Arabia and South Korea; it linked APT33's DROPSHOT dropper to the SHAPESHIFT wiper but had not observed the group carry out destructive operations. Trademark TTPs: password spraying at scale against M365/Entra ID, exploitation of Zoho ManageEngine and Atlassian Confluence, deployment of custom Tickler and FalseFont backdoors. Microsoft Threat Intelligence (Aug 2024): Tickler backdoor deployed against satellite, oil & gas, and government targets in the US and the UAE via Azure-hosted infrastructure. Nozomi Networks telemetry (Jul 2025) attributed attacks on at least three US companies, mainly in transportation and manufacturing, to APT33 during May–June 2025; no 2026 activity has been publicly attributed to the group.

Attribution

Islamic Revolutionary Guard Corps

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• Microsoft Threat Intelligence (Research, 2024-08-28)
  Iranian state-sponsored actor Peach Sandstorm, operating on behalf of the IRGC
• MITRE ATT&CK (MITRE ATT&CK, 2026-10)
  Suspected Iranian

Campaigns 4

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 7

Malware and tools 5

Exploited vulnerabilities 3

Highest CVSS first.

Infrastructure patterns

• Password sprays from Tor exits ("go-http-client" UA); follow-on logins via commercial VPNs (Microsoft, 2023; Microsoft, 2024)
• Fraudulent Azure subscriptions, bought via compromised education accounts, host Tickler C2 (Microsoft, 2024)
• Azure Arc links victim devices to its Azure subscription; EagleRelay tunnels traffic out (Microsoft, 2023)
• HTTP C2 over non-standard TCP ports 808 and 880 (MITRE ATT&CK, 2026)

Reporting and advisories 6

• Microsoft Threat Intelligence
  Peach Sandstorm password spray & Zoho/Confluence exploitation wave
• Microsoft Threat Intelligence
  Tickler backdoor deployments
• Nozomi Networks Labs
  US transportation & manufacturing attacks (Israel–Iran war period)
• MITRE ATT&CK
  Refined Kitten (G0064) group profile
• Mandiant (FireEye)
  Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware (Sep 2017)
• BleepingComputer, reporting Microsoft Threat Intelligence
  Microsoft: Hackers target defense firms with new FalseFont malware (Dec 2023)