Security researchers have a habit of naming Iranian hacking crews after cats. The Middle East Institute notes that Chinese groups are “Pandas,” Russian ones “Bears,” and Iranian ones “Kittens.” It is a cute label for a serious list: the institute counts eight groups attributed to the Islamic Republic.
The attribution comes with a caveat that matters. These actors are identified forensically, by shared tactics, similar code and the industries they hit, not by human intelligence inside the Iranian government. One MEI analyst put the limit plainly: “we don’t have insight into which APT is Ministry of Intelligence vs. IRGC.” Pinning every group on the Revolutionary Guard, in other words, goes further than the public evidence does.
The main groups
APT33 goes by Elfin and Refined Kitten. It has been active since 2013 and aims at strategic espionage, with the U.S., Saudi Arabia and South Korea as targets and aviation, energy and petrochemical firms in the crosshairs. Its way in is usually spearphishing built around recruitment, with fake job descriptions and fake job websites.
APT34, also called OilRig or Helix Kitten, dates to 2014. MEI lists malware including ZEROCLEARE and DNSPIONAGE, and describes approaches such as academia-themed conversations and LinkedIn messages carrying malicious links. Its main focus is the Middle East, particularly Lebanon and the UAE.
APT35 answers to Charming Kitten, among many other names, and has also been active since 2014. Its list of victims is long: military, government, media, energy, defense contractors, telecommunications and dissidents.
APT39, known as Chafer or Remix Kitten, is the one built to watch people. MEI says its goal is stealing personal information to support Iranian priorities such as monitoring and tracking dissidents. It went after telecommunications and travel firms in the Middle East and Persian Gulf, Spain, the U.S. and Australia, and used a front company called Rana.
From espionage to disruption
New Jersey’s cybersecurity cell, the NJCCIC, takes a longer view. Its timeline starts with the Iranian Cyber Army in 2009 and 2010, which defaced websites and hijacked DNS. Operation Newscaster, from 2011 to 2014, used fake social media personas to target thousands of people worldwide. CyberAv3ngers, active since 2020, goes after water facilities and energy-related operational technology, mostly by exploiting poorly secured or internet-exposed industrial control systems.
The NJCCIC says Iranian activity is shifting “from purely intelligence-gathering to more aggressive and opportunistic operations designed to establish access, disrupt services, or advance geopolitical narratives.” Its list of known tools includes Shamoon, ZeroCleare and Dustman, along with credential-harvesting and wiper malware. Groups linked to Iran carried out the Shamoon wiper attacks in 2012 and 2016.
The NJCCIC’s advice to defenders is unglamorous: tighten identity security, patch internet-facing systems, and watch for phishing and password spraying.
Sources
- Iranian APTs: An overview – Middle East Institute
- Iran Cyber Threat Operations – NJCCIC (New Jersey Cybersecurity and Communications Integration Cell)
