Analysis of Fox Kitten Infrastructure Reveals Unique Host Patterns and Potentially New IOCs
Tags
country: Iran
attack-pattern: Datasets Confluence - T1213.001 Dns - T1071.004 Dns - T1590.002 Ip Addresses - T1590.005 Software - T1592.002 Ssh - T1021.004
Show in Graph
Common Information
Type Value
UUID 5753bd68-f136-4191-a9a4-70af97d90b2f
Fingerprint a4284157bc39b585
Analysis status DONE
Considered CTI value 0
Text language
Published Sept. 17, 2024, 4:11 p.m.
Added to db Sept. 30, 2024, 7:36 p.m.
Last updated Oct. 1, 2024, 1:08 p.m.
Headline Analysis of Fox Kitten Infrastructure Reveals Unique Host Patterns and Potentially New IOCs
Title Analysis of Fox Kitten Infrastructure Reveals Unique Host Patterns and Potentially New IOCs
Detected Hints/Tags/Attributes 42/2/16
Source URLs
Redirection Url
Details Source https://censys.com/analysis-of-fox-kitten-infrastructure-reveals-unique-host-patterns-and-potentially-new-iocs/
URL Provider
Details Provider Source level domain
Details censys.com censys.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 77 ✔ Censys https://censys.io/feed 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 1 
futureenergy.us
Details Domain 1 
next-finance.mil
Details Domain 1 
schneider-electric.oil-bright.mil
Details Domain 4 
api.gupdate.net
Details Domain 4 
githubapp.net
Details Domain 4 
login.forticloud.online
Details Domain 3 
fortigate.forticloud.online
Details Domain 4 
cloud.sophos.one
Details Domain 1 
cloud.sophos.com
Details File 1 
next-finance.mil
Details File 1 
oil-bright.mil
Details File 1 
aa24-241a-iran-based-cyber-actors-enabling-ransomware-attacks-on-us-organizations_0.pdf
Details IPv4 1 
64.176.165.17
Details IPv4 1 
70.34.218.77
Details IPv4 1 
18.130.251.165
Details Url 1 
https://www.cisa.gov/sites/default/files/2024-08/aa24-241a-iran-based-cyber-actors-enabling-ransomware-attacks-on-us-organizations_0.pdf