RedKitten is a Farsi-speaking threat actor aligned with Iranian state interests, first observed engaging in cyber espionage activities in early January 2026, though preparatory actions like GitHub Gists date back to October 2025. This group emerged during the "Dey 1404 Protests" in Iran, which began in late December 2025. Their primary motivation is cyber espionage and surveillance, specifically targeting human rights NGOs, activists, academics, and government officials involved in documenting human rights abuses during the Iranian protests. What uniquely distinguishes RedKitten is its notable reliance on large language models for developing its tooling, as evidenced by AI-generated VBA macros, marking a significant evolution in Iranian state-sponsored cyber tactics. The group effectively exploits the emotional distress of victims by using fabricated lists of deceased protesters as lures to initiate their attacks. While their tactics share overlaps with other Iranian APTs like Tortoise

Actores similares

Fox Kittenapt · 1Charming Kittenactor · 1cutting-kittenactor · 1clever-kittenactor · 1charming-kittenactor · 1rocket-kittenactor · 1flash-kittenactor · 1domestic-kittenactor · 1fox-kittenactor · 1tracer-kittenactor · 1