🇮🇷

AjaxTM

APT Group Information theft and espionage ETDA ✓

Also Known As 7 names

Flying Kitten Ajax Security Team AjaxSecurityTeam Group 26 Saffron Rose SaffronRose Sayad

Target Countries 1

Countries highlighted in red

United States

Sectors Targeted

Defense dissidents

Details

Origin 🇮🇷 IR

Last Updated 03 Apr 2025

MITRE ATT&CK 27

T1018 - Remote System Discovery T1021 - Remote Services T1040 - Network Sniffing T1045 - Software Packing T1053 - Scheduled Task/Job T1055 - Process Injection T1056 T1056.001 - Keylogging T1057 - Process Discovery T1060 - Registry Run Keys / Startup Folder T1071 - Application Layer Protocol T1082 - System Information Discovery T1105 - Ingress Tool Transfer T1112 - Modify Registry T1119 - Automated Collection T1129 - Shared Modules T1133 - External Remote Services T1143 - Hidden Window T1204 - User Execution T1204.002 - Malicious File T1480 - Execution Guardrails T1553 - Subvert Trust Controls T1555 T1555.003 - Credentials from Web Browsers T1566 T1566.001 - Spearphishing Attachment T1566.003 - Spearphishing via Service

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 4 entries

Flying Kitten CrowdStrike

Ajax Security Team FireEye

Group 26 Talos

G0130 MITRE

Observed Target Countries 1

Based on ETDA data — countries highlighted in red

USA

Description

(FireEye) Members of this group have accounts on popular Iranian hacker forums such as ashiyane[.]org and shabgard[.]org, and they have engaged in website defacements under the group name “AjaxTM” since 2010. By 2014, the Ajax Security Team had transitioned from performing defacements (their last defacement was in December 2013) to malware-based espionage, using a methodology consistent with other advanced persistent threat actors in this region. (Crowdstrike) CrowdStrike Intelligence has also been tracking and reporting internally on this threat group since mid-January 2014 under the name FLYING KITTEN, and since that time has seen targeting of multiple U.S.-based defense contractors as well as political dissidents.

Tools Used 1

Stealer

Operations 1

2013 Operation “Saffron Rose” https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-operation-saffron-rose.pdf

Reports & References 1

https://www.crowdstrike.com/blog/cat-scratch-fever-crowdstrike-tracks-newly-reported-iranian-actor-flying-kitten/

ETDA Profile

Flying Kitten, Ajax Security Team

Origin

Iran

First Seen 2010

Sponsor State-sponsored

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0130/

View on ETDA APT Groups ↗