Pioneer Kitten Threat Actor Profile Guide: Iranian VPN Access Sold to Ransomware

Pioneer Kitten is an Iran-based group that exploits VPN gateways and other edge devices, then hands the access it gains to ransomware affiliates while also running espionage for the Iranian government. A joint FBI, CISA and DoD Cyber Crime Center advisory in August 2024 described the group collaborating with ALPHV (BlackCat), NoEscape and RansomHouse affiliates and taking a share of ransom payments. That dual role means an unpatched Citrix, Ivanti, F5, PAN-OS or Check Point device can lead either to a nation-state intrusion or to encryption, and often you cannot tell which until late. This profile covers names, targeting, ATT&CK techniques, the accounts and credentials the group creates and steals, and the detection and hardening work that closes its usual path. It is for network, identity and SOC teams and for threat intelligence analysts.

Key takeaways

• One group, many names. ATT&CK tracks it as G0117 Fox Kitten; Pioneer Kitten, UNC757, Parisite, RUBIDIUM and Lemon Sandstorm are vendor names for the same or overlapping activity.
• Access broker and spy at once. The FBI assesses the group conducts espionage for the Government of Iran and, separately, sells or shares network access with ransomware affiliates, an activity the FBI judges is likely not sanctioned by the government.
• Edge devices are the front door. The 2024 advisory lists CVE-2019-19781 and CVE-2023-3519 (Citrix NetScaler), CVE-2022-1388 (F5 BIG-IP), CVE-2024-21887 (Ivanti), CVE-2024-3400 (PAN-OS) and scanning for CVE-2024-24919 (Check Point).
• Persistence hides in accounts and tasks. The group creates accounts named to look like service accounts, plants web shells that capture logon credentials, and adds scheduled tasks and remote access tools.
• Patching is not eviction. The advisory warns that a device compromised while vulnerable may still give the actor access after it is patched, so credentials and lateral movement must be investigated.

Who they are (names and aliases)

MITRE ATT&CK describes G0117 Fox Kitten as a threat actor with a suspected nexus to the Iranian government, active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia and North America, and lists the associated names UNC757, Parisite, Pioneer Kitten, RUBIDIUM and Lemon Sandstorm. Advisory AA24-241A, released on 28 August 2024 by the FBI, CISA and DC3, uses the same set of private sector names, records that the actors use the online monikers Br0k3r and xplfinder, and says they have operated under the Iranian company name Danesh Novin Sahand, which the FBI assesses is likely a cover IT entity.

ClearSky's February 2020 "Fox Kitten" report assessed a medium to high probability of overlap with APT34 (OilRig) infrastructure and noted that Dragos had first identified the activity as Parisite. Vendor clusters overlap imperfectly, so compare techniques rather than names. See the Threat Actor Naming Conventions Guide, the Iran State Cyber Operations Guide and the OilRig Threat Actor Profile Guide.

Targeting and motivation

ATT&CK lists oil and gas, technology, government, defence, healthcare, manufacturing and engineering. AA24-241A names US education, finance, healthcare, defence and local government organisations, plus organisations in Israel, Azerbaijan and the United Arab Emirates. ClearSky observed that IT service companies were prized because one breach could expose their clients, and that the group kept several access points in each network so that closing one did not end the intrusion.

The motivations are mixed:

• Espionage: the FBI assesses the group's core mission is stealing sensitive technical data for the Government of Iran.
• Financial: the actors enable ransomware by affiliates in exchange for a percentage of ransom payments, and the FBI says they are intentionally vague with affiliates about their nationality and origin.
• Influence operations: the late 2020 Pay2Key campaign leaked victim data and was assessed by the FBI as an information operation against Israel-based infrastructure rather than a genuine ransom effort.

Because it supplies access to others, this group is a textbook initial access broker. See the Initial Access Brokers Guide and Top 10 Ransomware Initial Access Vectors.

Tactics and techniques (MITRE ATT&CK)

Techniques below are from ATT&CK v20 for G0117 unless marked as taken from AA24-241A. The list is selective, focused on what defenders can detect.

Vulnerabilities named in AA24-241A

ClearSky reported that Iranian groups could weaponise newly published one-day vulnerabilities within hours to a week or two, so your patch window for these device classes should be measured in days.

How they abuse identities and credentials

• Harvesting at the gateway: AA24-241A describes web shells on compromised NetScaler devices capturing logon credentials and writing them to a file named netscaler.1. Every user who authenticated through that device afterwards should be treated as exposed.
• Accounts that look like service accounts: the advisory lists created accounts including sqladmin$, adfsservice, IIS_Admin and iis-admin. A trailing dollar sign mimics a computer account, and names echoing ADFS and IIS blend into the service account sprawl most directories carry. See the Service Account Security Guide.
• Federation servers as targets: a malicious version.dll was placed in C:\Windows\ADFS\, the directory of the AD FS service that signs tokens for federated applications. See the Federation and Trust Relationships Guide.
• Service account reconnaissance: ATT&CK records LDAP browsing of service account documentation, and credential theft from KeePass and files. Undocumented, over-privileged service accounts give the group fast routes to domain-wide access.
• Remote access tools as backup identities: AnyDesk and MeshCentral installs give access that survives a VPN credential reset. See the RMM Tool Security Guide.

Notable incidents

• Fox Kitten campaign (reported February 2020): ClearSky described about three years of operations against IT, telecommunications, oil and gas, aviation, government and security companies, mostly through unpatched VPN and RDP services.
• Pay2Key (November 2020): Check Point reported ransomware attacks on Israeli companies from 1 November 2020, probably through RDP, with encryption spread across a network within an hour using PsExec and ransom demands of 7 to 9 bitcoin. The FBI later assessed the campaign as an information operation. ATT&CK tracks the malware as S0556 Pay2Key.
• Ransomware collaboration (advisory August 2024): AA24-241A describes the group working with ALPHV, NoEscape and RansomHouse affiliates against US organisations, with indicators observed into August 2024. See the ALPHV BlackCat Threat Actor Profile.

Detection and defence

What to hunt for

Hardening and response sequence

1. Patch and verify edge devices: prioritise the CVEs above on every internet-facing appliance; replace end-of-life devices. See the Edge Device Security Guide and the Edge Device Exploitation by Threat Actors Guide.
2. Assume compromise where exposure preceded the patch: run vendor integrity tools, look for the web shell paths, and image the device before rebuilding.
3. Reset credentials that touched the device: all users and service accounts that authenticated through a compromised gateway, plus the device's own LDAP or RADIUS bind accounts.
4. Sweep the directory: review all accounts created since the exposure date, remove unknown ones, and review membership of privileged groups.
5. Control remote access tooling: block unapproved RMM and tunnelling tools by application control and egress filtering.
6. Require phishing-resistant MFA on VPN and remote access: stolen passwords then stop being enough. See the VPN Security Guide.

Small and large organisations

Smaller organisations: with one or two gateways and no 24x7 SOC, the most effective moves are subscribing to vendor and CISA KEV alerts, patching within days, forwarding device logs to a managed service, and having a rebuild plan for the appliance. If you cannot patch quickly, take the management interface and portal off the internet until you can. Larger organisations: track every edge device in the asset inventory with owner and firmware, hunt across the fleet when a new advisory lands, and treat accounts created on or through edge devices as a monitored privileged population. In both cases, the decision to rebuild rather than patch in place should be made whenever exploitation predates the fix.

Metrics

• Edge KEV exposure: median days from KEV listing to patch on internet-facing devices.
• Unexplained privileged accounts: count of privileged accounts with no owner or ticket, trending to zero.
• Unapproved remote tools: number of hosts running RMM or tunnelling software outside the approved list.
• MFA coverage: percentage of remote access paths requiring phishing-resistant MFA.
• Device log coverage: percentage of edge devices forwarding logs off-box to the SIEM.

Framework mapping

Practitioner checklist

• Confirm every internet-facing Citrix, F5, Ivanti, PAN-OS and Check Point device is patched for the CVEs listed in AA24-241A.
• For any device that was exposed before patching, run integrity checks and hunt for the advisory's web shell paths.
• Search the directory for the account names in the advisory and for any privileged account created without a ticket.
• Alert on Windows Event IDs 4720, 4732 and 4698 on domain controllers, AD FS and other Tier 0 servers.
• Monitor AD FS servers for unexpected DLLs in the service directory.
• Block ngrok, Ligolo and unapproved RMM tools at the endpoint and on egress.
• Reset credentials for everyone who authenticated through a compromised gateway, including service and bind accounts.
• Require phishing-resistant MFA on all VPN and remote access paths.
• Load the advisory's IOCs into your SIEM, vetting them first, as the advisory advises.

Standards and references

• FBI, CISA and DC3: AA24-241A Iran-based Cyber Actors Enabling Ransomware Attacks on US Organizations
• MITRE ATT&CK: Fox Kitten (G0117)
• ClearSky: Fox Kitten Campaign
• Check Point Research: Ransomware Alert, Pay2Key
• CISA: Known Exploited Vulnerabilities Catalog
• NIST: SP 800-53 Rev. 5
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: Top 10 Ransomware Initial Access Vectors · Initial Access Brokers Guide · Iran State Cyber Operations Guide · Charming Kitten (APT35) Threat Actor Profile · Unauthorised Remote Monitoring and Management Tool Playbook