Loading threat actor…
Nemesis Kitten is an Iranian state-aligned intrusion set associated with the APT35 cluster and linked to the Islamic Revolutionary Guard Corps Intelligence Organization (IRGC-IO). It has also been referred to as TunnelVision and Cobalt Mirage. Reporting has described the group as being operated by the private companies Afkar System and Najee Technologies under contract to the IRGC-IO, reflecting Iran’s broader use of contractors to support state cyber operations. Nemesis Kitten is primarily associated with espionage activity, but it has also been linked to lucrative cyber operations including ransomware. The group has been cited as exploiting newly disclosed and widely known internet-facing vulnerabilities, including flaws in VPN and enterprise edge technologies, to obtain initial access. It is also associated with social engineering and spearphishing tradecraft seen across Iranian intrusion sets. Public reporting has noted overlap between Nemesis Kitten and other Iranian actors such as Charming Kitten and Tortoiseshell, and a sub-cluster attributed to Nemesis Kitten has been observed using GitHub as a delivery and staging mechanism for malware. The actor has been connected to operations targeting regional and Western adversaries in line with Iranian intelligence priorities. Broader reporting on Iranian cyber activity places Nemesis Kitten among groups targeting critical infrastructure and strategic sectors, including energy and telecommunications, as well as organizations and individuals of intelligence interest. Nemesis Kitten has also been named among threat actors exploiting high-profile vulnerabilities at scale. Overall, Nemesis Kitten is best characterized as an Iran-linked, IRGC-associated threat actor that combines opportunistic exploitation of exposed systems with intrusion activity aligned to state espionage objectives, while also showing involvement in financially motivated ransomware-related operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Suspected IRGC-affiliated ransomware operator using hacktivist branding and psychological operations; employs data theft + encryption + leak (double extortion) to undermine confidence in critical infrastructure.
Referenced as an established Iranian APT with TTP overlap to RedKitten; mentioned in references in connection with the Drokbk backdoor (not described in-body).
Iranian nation-state group referenced for prior use of GitHub as a delivery conduit for a backdoor (Drokbk), providing precedent for the GitHub dead-drop technique.
Nemesis Kitten is a threat actor group that exploited several of the top twelve most exploited vulnerabilities in 2022, focusing on opportunistic attacks against unpatched systems.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.