Ajax Security Team

Introduction

Ajax Security Team is a group that has been active since at least 2010 and believed to be operating out of Iran. By 2014 Ajax Security Team transitioned from website defacement operations to malware-based cyber espionage campaigns targeting the US defense industrial base and Iranian users of anti-censorship technologies. FireEye Operation Saffron Rose 2013

Activities and Tactics

Targeted Sectors: Aerospace, Defense, Gas, Oil, Military, Civil society, Activists, Journalist, Research - Innovation, Academia - University, Government, Administration, Government

Country of Origin: 🇮🇷 Iran

Incident Type: Espionage

Suspected Victims: United States, Iranian internet activists, Saudi Arabia, Venezuela, Afghanistan, United Arab Emirates, Iran, Israel, Iraq, Kuwait…

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

• T1056.001 Keylogging
• T1566.003 Spearphishing via Service
• T1566.001 Spearphishing Attachment
• T1204.002 Malicious File
• T1555.003 Credentials from Web Browsers
• T1105 Ingress Tool Transfer

ATT&CK technique IDs (denormalized)

• T1056.001
• T1105
• T1204.002
• T1555.003
• T1566.001
• T1566.003

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

MITRE ATT&CK Software

• sqlmap (S0225) — tool
• Havij (S0224) — tool

Attribution and Evidence

Country of Origin: Iran Additional attribution information pending cataloguing.

References

[1] mitre-attack [7] TrendMicro Operation Woolen Goldfish March 2015 Cedric Pernet, Kenney Lu. (2015, March 19). Operation Woolen-Goldfish - When Kittens Go phishing. Retrieved April 21, 2021. [8] Check Point Rocket Kitten Check Point Software Technologies. (2015). ROCKET KITTEN: A CAMPAIGN WITH 9 LIVES. Retrieved March 16, 2018. [9] CrowdStrike Flying Kitten Dahl, M.. (2014, May 13). Cat Scratch Fever: CrowdStrike Tracks Newly Reported Iranian Actor as FLYING KITTEN. Retrieved May 27, 2020. [10] IranThreats Kittens Dec 2017 Iran Threats . (2017, December 5). Flying Kitten to Rocket Kitten, A Case of Ambiguity and Shared Code. Retrieved May 28, 2020. [11] FireEye Operation Saffron Rose 2013 Villeneuve, N. et al.. (2013). OPERATION SAFFRON ROSE . Retrieved May 28, 2020.