Ferocious Kitten
Overview
Ferocious Kitten is a threat group that has primarily targeted Persian-speaking individuals in Iran since at least 2015.
Naming & attribution
It uses 6 documented ATT&CK techniques — more than 17% of the 174 groups tracked here. Activity attributed since at least 2015.
Closest groups by technique overlap
Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.
- IndigoZebra China — 4 shared techniques (44% overlap)
- DarkHydrus — 3 shared techniques (30% overlap)
- BlackTech China — 4 shared techniques (25% overlap)
- Transparent Tribe Pakistan — 4 shared techniques (25% overlap)
- Whitefly — 3 shared techniques (25% overlap)
- BITTER — 4 shared techniques (22% overlap)
Malware families with tracked indicators
One family attributed to Ferocious Kitten, with 3 deduplicated indicators observed across abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL over the corpus's window (up to three years, as of 2026-10-30). MITRE documents what a group does; these are the indicators its malware families have surfaced in that window.
- MarkiRAT3 indicators
Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.
TTPs — 6 techniques across 4 tactics
Initial Access
T1566.001Spearphishing Attachment
Execution
T1204.002Malicious File
Stealth
T1036.002Right-to-Left OverrideT1036.005Match Legitimate Resource Name or Location
Tools & malware (2)
MarkiRAT · BITSAdmin