Tracer Kitten
Description
(CrowdStrike) In April 2020, OverWatch discovered Iran-based adversary TRACER KITTEN conducting malicious interactive activity against multiple hosts at a telecommunications company in the Europe, Middle East and Africa (EMEA) region. The actor was found operating under valid user accounts, using custom backdoors in combination with SSH tunnels for C2. The adversary leveraged their foothold to conduct a variety of reconnaissance activities, undertake credential harvesting and prepare for data exfiltration.
Telecommunications is currently the third most frequently targeted vertical. This industry still remains firmly within the crosshairs for targeted attacks, the motivations of which are likely associated with espionage and data theft objectives.
Names
| Name | Name-Giver |
|---|---|
| Tracer Kitten | CrowdStrike |
Country
Motivation
- Information theft and espionage
First Seen
2020
Observed Sectors
Observed Countries
Information
Other Information
Uuid
cabd014b-5087-4ff8-b0c8-74202e82fa1d
Last Card Change
2022-12-31