Pioneer Kitten 🐈..!

Pioneer Kitten is trying to monetize by selling access to some of the networks it has hacked to other hackers.Iran’s state-sponsored hacking groups selling access to compromised corporate networks on an underground hacking forum.

“PIONEER KITTEN tradecraft is characterized by a pronounced reliance on exploits of remote external services on internet-facing assets to achieve initial access to victims, as well as almost total reliance on open-source tooling during operations,”.

The Iranian hacker group has been hacking VPN servers over the past few months to plant backdoors in companies around the world targeting Pulse Secure, Fortinet, Palo Alto Networks, and Citrix VPNs.

Pioneer Kitten

The hacking group is an Iran-based adversary, active since 2017. This adversary focuses on gaining and maintaining access to entities possessing sensitive information of likely intelligence interest to the Iranian government.

The codename Pioneer Kitten is an alternative designation for the group, also known as Fox Kitten or Parasite.

Pioneer Kitten exploits

The group is interested in exploits related to multiple vulnerabilities in VPNs and networking devices, including

PIONEER KITTEN’s namesake operational characteristic is its reliance on SSH tunnelling, through open-source tools such as Ngrok and the adversary’s custom tool SSHMinion, for communication with implants and hands-on-keyboard activity via Remote Desktop Protocol (RDP).

Pioneer Kitten Targets

The group have focused their attacks against entities in North America and Israeli, targeting sectors including government, technology, aviation, healthcare, media, defense, consulting and professional services, academic, engineering, chemical, manufacturing, insurance, financial services and retail.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s