Rocket Kitten

APT Group Information theft and espionage ETDA ✓

Also Known As 5 names

Thamar Reservoir TEMP.Beanie Operation Woolen Goldfish Operation Woolen-Goldfish Timberworm

Target Countries 12

Countries highlighted in red

Brazil China Germany Algeria Israel India Japan Kazakhstan Romania Turkey Ukraine United States

Sectors Targeted

Embassies Entertainment Defense Government Media Manufacturing Construction Education

Details

Origin 🇮🇷 IR

Last Updated 21 Apr 2026

Malware Families 4

disttrack

ghole

woolger

firemalv

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 5 entries

Rocket Kitten CrowdStrike

Newscaster Symantec

NewsBeef Kaspersky

Group 83 Talos

Parastoo Flashpoint

Observed Target Countries 14

Based on ETDA data — countries highlighted in red

Algeria Brazil China Germany India Israel Japan Kazakhstan Romania Russia Turkey UK Ukraine USA

Description

(Kaspersky) Newsbeef/Newscaster will find a way to compromise a web site, usually the vulnerability appears to be CMS related, in an outdated WordPress plugin, Joomla version, or Drupal version. Attackers usually perform one of two things, Newsbeef has been performing the first of the two: - inject a src or iframe link into web pages or css sheets - inject the content of an entire BeEF web page into one of the internally linked javascript helpers The injected link will redirect visitors’ browsers to a BeEF server. Usually, the attackers deliver some of the tracking and system/browser identification and evercookie capabilities. Sometimes, it appears that they deliver the metasploit integration to exploit and deliver backdoors (we haven’t identified that exploitation activity in our ksn data related to this group just yet). Sometimes, it is used to pop up spoofed login input fields to steal social networking site credentials. We also haven’t detected that in ksn, but some partners have privately reported it about various incidents. But we have identified that attackers will redirect specific targets to laced Adobe Flash and other installers from websites that they operate. So, the watering hole activity isn’t always and usually isn’t delivering backdoors. Most of the time, the watering hole injections are used to identify and track visitors or steal their browser history. Then, they deliver the backdoors to the right targets. There is some infrastructure overlap with {{Magic Hound, APT 35, Cobalt Illusion, Charming Kitten}} and {{ITG18}}.

Tools Used 3

BeEF FireMalv Ghole

Operations 5

2011 Operation “Newscaster” The research firm iSight dubbed the operation Newscaster and said hackers used social-media sites like Twitter, Facebook and LinkedIn to draw their targets and then lure them to check out a bogus news site, NewsOnAir.org, filled with foreign policy and defense articles, The Post reported. The overall aim is that the social-media platform would give the hackers connections with those at the top of public policy — and position them to tap into that information network. https://www.washingtontimes.com/news/2014/may/29/iranian-hackers-sucker-punch-us-defense-heads-crea/

2015-02 Operation “Woolen-GoldFish” https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/operation-woolen-goldfish-when-kittens-go-phishing

2016-02 In late February 2016, a University website in Iran stood out for thoroughly vetting its current and potential students and staff. The University’s web site served repackaged content from the Browser Exploitation Framework (BeEF) with embedded JavaScript content. https://securelist.com/freezer-paper-around-free-meat/74503/

2017 Fake news website BritishNews to infect visitors On the same note, we identified a fake-news agency “established” by the attackers, called “The British news agency” or “Britishnews” (inspired by BBC). Its website domain is britishnews.com[.]co and two other domains, broadcastbritishnews[.] ommand britishnews[.]org redirected to it.

2017 Blackmailing BBC reporter with ‘naked photo’ threats Iranian agents blackmailed a BBC Persian journalist by threatening to publish revealing photos of her as part of a wider campaign against the British media outlet, staff at the broadcaster told Arab News. New details emerged on Saturday about alleged harassment of BBC Persian reporters’ family members and loved ones at the hands of the Iranian security services. http://www.arabnews.com/node/1195681/media

Reports & References 3

https://securelist.com/freezer-paper-around-free-meat/74503/ https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-the-spy-kittens-are-back.pdf

ETDA Profile

Rocket Kitten, Newscaster, NewsBeef

Origin

Iran

First Seen 2011

Sponsor State-sponsored

Motivation

Information theft and espionage

View on ETDA APT Groups ↗