🇮🇷

TRACER KITTEN

APT Group Information theft and espionage 2 zero-day CVEs ETDA ✓

Also Known As

No alias recorded

Target Countries

No target country recorded

Sectors Targeted

Telecommunications

Details

Origin 🇮🇷 IR

Last Updated 01 Jun 2022

MITRE ATT&CK 12

T1036 - Masquerading T1059 - Command and Scripting Interpreter T1059.001 T1070 - Indicator Removal on Host T1071.001 T1125 - Video Capture T1176 - Browser Extensions T1189 - Drive-by Compromise T1193 T1195 - Supply Chain Compromise T1199 - Trusted Relationship T1547 - Boot or Logon Autostart Execution

Related Zero-Days 2

CVE-2021-40444 CVE-2025-22457

Known Names 1 entries

Tracer Kitten CrowdStrike

Observed Target Countries 1

Based on ETDA data — countries highlighted in red

Europe, Middle East and Africa

Description

(CrowdStrike) In April 2020, OverWatch discovered Iran-based adversary TRACER KITTEN conducting malicious interactive activity against multiple hosts at a telecommunications company in the Europe, Middle East and Africa (EMEA) region. The actor was found operating under valid user accounts, using custom backdoors in combination with SSH tunnels for C2. The adversary leveraged their foothold to conduct a variety of reconnaissance activities, undertake credential harvesting and prepare for data exfiltration. Telecommunications is currently the third most frequently targeted vertical. This industry still remains firmly within the crosshairs for targeted attacks, the motivations of which are likely associated with espionage and data theft objectives.

Reports & References 1

https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020OverWatchNowheretoHide.pdf

ETDA Profile

Tracer Kitten

Origin

Iran

First Seen 2020

Motivation

Information theft and espionage

View on ETDA APT Groups ↗