SYMBOLCOMMON_NAMEaka. SYNONYMS

Rocket Kitten  (Back to overview)

aka: Operation Woolen Goldfish, Operation Woolen-Goldfish, TEMP.Beanie, Thamar Reservoir, Timberworm

Targets Saudi Arabia, Israel, US, Iran, high ranking defense officials, embassies of various target countries, notable Iran researchers, human rights activists, media and journalists, academic institutions and various scholars, including scientists in the fields of physics and nuclear sciences.

Associated Families
win.disttrack win.firemalv win.ghole win.matryoshka_rat win.mpkbot win.pupy win.tdtess win.woolger
References
2023-01-04 ⋅ K7 Security ⋅ Saikumaravel
Pupy RAT hiding under WerFault’s cover
pupy
2022-09-26 ⋅ CrowdStrike ⋅ Ioan Iacob, Iulian Madalin Ionita
The Anatomy of Wiper Malware, Part 3: Input/Output Controls
CaddyWiper DEADWOOD DistTrack DoubleZero DUSTMAN HermeticWiper IsaacWiper Meteor Petya Sierra(Alfa,Bravo, ...) StoneDrill WhisperGate ZeroCleare
2022-08-12 ⋅ CrowdStrike ⋅ Ioan Iacob, Iulian Madalin Ionita
The Anatomy of Wiper Malware, Part 1: Common Techniques
Apostle CaddyWiper DEADWOOD DistTrack DoubleZero DUSTMAN HermeticWiper IsaacWiper IsraBye KillDisk Meteor Olympic Destroyer Ordinypt Petya Sierra(Alfa,Bravo, ...) StoneDrill WhisperGate ZeroCleare
2022-06-20 ⋅ ⋅ Infinitum IT ⋅ infinitum IT
Charming Kitten (APT35)
LaZagne DownPaper MimiKatz pupy
2022-06-15 ⋅ Volexity ⋅ Steven Adair, Thomas Lancaster, Volexity Threat Research
DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach
pupy Sliver DriftingCloud
2022-05-23 ⋅ Trend Micro ⋅ Daniel Lunghi, Jaromír Hořejší
Operation Earth Berberoka
reptile oRAT Ghost RAT PlugX pupy Earth Berberoka
2022-04-28 ⋅ Fortinet ⋅ Gergely Revay
An Overview of the Increasing Wiper Malware Threat
AcidRain CaddyWiper DistTrack DoubleZero EternalPetya HermeticWiper IsaacWiper Olympic Destroyer Ordinypt WhisperGate ZeroCleare
2022-04-27 ⋅ Trendmicro ⋅ Trendmicro
IOCs for Earth Berberoka - Linux
Rekoobe pupy Earth Berberoka
2022-03-30 ⋅ Recorded Future ⋅ Insikt Group
Social Engineering Remains Key Tradecraft for Iranian APTs
Liderc pupy
2022-03-08 ⋅ Cylera ⋅ Cylera
The link between Kwampirs (Orangeworm) and Shamoon APTs
DistTrack Kwampirs
2021-08-05 ⋅ Symantec ⋅ Threat Hunter Team
Attacks Against Critical Infrastructure: A Global Concern
BlackEnergy DarkSide DistTrack Stuxnet
2020-02-13 ⋅ Qianxin ⋅ Qi Anxin Threat Intelligence Center
APT Report 2019
Chrysaor Exodus Dacls VPNFilter DNSRat Griffon KopiLuwak More_eggs SQLRat AppleJeus BONDUPDATER Agent.BTZ Anchor AndroMut AppleJeus BOOSTWRITE Brambul Carbanak Cobalt Strike Dacls DistTrack DNSpionage Dtrack ELECTRICFISH FlawedAmmyy FlawedGrace Get2 Grateful POS HOPLIGHT Imminent Monitor RAT jason Joanap KerrDown KEYMARBLE Lambert LightNeuron LoJax MiniDuke PolyglotDuke PowerRatankba Rising Sun SDBbot ServHelper Snatch Stuxnet TinyMet tRat TrickBot Volgmer X-Agent Zebrocy
2020-02-10 ⋅ ZDNet ⋅ Catalin Cimpanu
FBI warns about ongoing attacks against software supply chain companies
DistTrack Kwampirs
2020-01-23 ⋅ Recorded Future ⋅ Insikt Group
European Energy Sector Organization Targeted by PupyRAT Malware in Late 2019
pupy pupy pupy
2019-12-21 ⋅ MalwareInDepth ⋅ Myrtus 0x0
Shamoon 2012 Complete Analysis
DistTrack
2019-11-19 ⋅ FireEye ⋅ Kelli Vanderlee, Nalani Fraser
Achievement Unlocked: Chinese Cyber Espionage Evolves to Support Higher Level Missions
MESSAGETAP TSCookie ACEHASH CHINACHOPPER Cobalt Strike Derusbi Empire Downloader Ghost RAT HIGHNOON HTran MimiKatz NetWire RC poisonplug Poison Ivy pupy Quasar RAT ZXShell
2019-08-22 ⋅ Github (n1nj4sec) ⋅ n1nj4sec
Pupy RAT
pupy pupy pupy
2019-03-27 ⋅ Symantec ⋅ Critical Attack Discovery and Intelligence Team
Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.
DarkComet MimiKatz Nanocore RAT NetWire RC pupy Quasar RAT Remcos StoneDrill TURNEDUP APT33
2019-03-27 ⋅ Symantec ⋅ Security Response Attack Investigation Team
Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.
DarkComet Nanocore RAT pupy Quasar RAT Remcos TURNEDUP APT33
2019-01-01 ⋅ Council on Foreign Relations ⋅ Cyber Operations Tracker
Rocket Kitten
Rocket Kitten
2018-12-21 ⋅ FireEye ⋅ Alex Orleans, Andrew Thompson, Geoff Ackerman, Nick Carr, Rick Cole
OVERRULED: Containing a Potentially Destructive Adversary
POWERTON PoshC2 pupy
2018-12-14 ⋅ Symantec ⋅ Critical Attack Discovery and Intelligence Team
Shamoon: Destructive Threat Re-Emerges with New Sting in its Tail
DistTrack Filerase StoneDrill OilRig
2018-12-13 ⋅ Palo Alto Networks Unit 42 ⋅ Robert Falcone
Shamoon 3 Targets Oil and Gas Organization
DistTrack
2017-07-25 ⋅ ClearSky ⋅ ClearSky Research Team
Operation Wilted Tulip – Exposing a Cyber Espionage Apparatus
Matryoshka RAT TDTESS CopyKittens
2017-07-01 ⋅ ClearSky ⋅ ClearSky, Trend Micro
OperationWilted Tulip
Matryoshka RAT CopyKittens
2017-03-26 ⋅ Palo Alto Networks Unit 42 ⋅ Bryan Lee, Robert Falcone
Shamoon 2: Delivering Disttrack
DistTrack
2017-03-14 ⋅ FireEye ⋅ FireEye
M-Trend 2017: A View From the Front Lines
DistTrack Powersniff FIN8
2017-02-27 ⋅ Symantec ⋅ A L Johnson
Shamoon: Multi-staged destructive attacks limited to specific targets
DistTrack MimiKatz Rocket Kitten
2017-02-27 ⋅ Symantec ⋅ Symantec Security Response
Shamoon: Multi-staged destructive attacks limited to specific targets
Rocket Kitten
2017-02-16 ⋅ SecurityAffairs ⋅ Pierluigi Paganini
Iranian hackers behind the Magic Hound campaign linked to Shamoon
pupy APT35
2017-02-15 ⋅ Secureworks ⋅ SecureWorks' Counter Threat Unit Research Team
Iranian PupyRAT Bites Middle Eastern Organizations
pupy Cleaver
2017-02-15 ⋅ Palo Alto Networks Unit 42 ⋅ Bryan Lee, Robert Falcone
Magic Hound Campaign Attacks Saudi Targets
Leash MPKBot pupy Rocket Kitten
2017-02-10 ⋅ ⋅ JPCERT/CC ⋅ Shusei Tomonaga
Malware that infects using PowerSploit
pupy
2017-02-05 ⋅ VinRansomware ⋅ Gregory Paul, Shaunak
Detailed threat analysis of Shamoon 2.0 Malware
DistTrack
2017-01-23 ⋅ Symantec ⋅ Symantec Security Response
Greenbug cyberespionage group targeting Middle East, possible links to Shamoon
DistTrack ISMDoor Greenbug
2017-01-23 ⋅ Symantec ⋅ Symantec Security Response
Greenbug cyberespionage group targeting Middle East, possible links to Shamoon
DistTrack ISMDoor Greenbug
2017-01-09 ⋅ Palo Alto Networks Unit 42 ⋅ Robert Falcone
Second Wave of Shamoon 2 Attacks Identified
DistTrack
2016-12-26 ⋅ Wikipedia ⋅ Wikipedia
Rocket Kitten
Rocket Kitten
2016-12-03 ⋅ Coding and Security ⋅ Coding, Security
"Sophisticated" and "Genius" Shamoon 2.0 Malware Analysis
DistTrack
2016-11-30 ⋅ Palo Alto Networks Unit 42 ⋅ Robert Falcone
Shamoon 2: Return of the Disttrack Wiper
DistTrack
2016-11-30 ⋅ Symantec ⋅ A L Johnson
Shamoon: Back from the dead and destructive as ever
DistTrack OilRig
2015-11-01 ⋅ Check Point ⋅ Check Point
ROCKET KIT TEN: A CAMPAIGN WITH 9 LIVES
FireMalv MPKBot Woolger Cleaver Rocket Kitten
2015-09-01 ⋅ Trend Micro ⋅ Cedric Pernet, Eyal Sela
The Spy Kittens Are Back: Rocket Kitten 2
Rocket Kitten
2015-08-27 ⋅ CitizenLab ⋅ John Scott-Railton, Katie Kleemola
London Calling: Two-Factor Authentication Phishing From Iran
Rocket Kitten
2015-06-03 ⋅ ClearSky ⋅ ClearSky Research Team
Thamar Reservoir – An Iranian cyber-attack campaign against targets in the Middle East
Rocket Kitten
2015-03-24 ⋅ Trend Micro ⋅ Cedric Pernet, Kenney Lu
Operation Woolen-Goldfish: When Kittens Go Phishing
Ghole Woolger
2015-03-19 ⋅ Trend Micro ⋅ Trend Micro
Rocket Kitten Showing Its Claws: Operation Woolen-GoldFish and the GHOLE campaign
Cleaver Rocket Kitten
2015-03-19 ⋅ Trend Micro ⋅ Cedric Pernet, Kenney Lu
Operation WOOLEN-GOLDFISH: When Kittens Go Phishing
Ghole Woolger
2014-09-04 ⋅ ClearSky ⋅ ClearSky Research Team
Gholee – a “protective edge” themed spear phishing campaign
Ghole
2012-08-17 ⋅ Contagiodump Blog ⋅ Mila Parkour
Shamoon or DistTrack.A samples
DistTrack
2012-08-16 ⋅ Kaspersky Labs ⋅ GReAT
Shamoon the Wiper – Copycats at Work
DistTrack
2012-08-16 ⋅ Symantec ⋅ Symantec Security Response
The Shamoon Attacks
DistTrack OilRig
Credits: MISP Project