Security Resilience

Threat actor · all actors

Fox KittenG0117 state

🇮🇷 IR

aka Fox Kitten, UNC757, Parisite, Pioneer Kitten, RUBIDIUM, Lemon Sandstorm

Last updated: 2026-10-16

11attributed CVEs
54ATT&CK techniques
26.1IDF score (tooling uniqueness)
1exclusive CVEs
2019–2026years active

About this actor

[Fox Kitten](https://attack.mitre.org/groups/G0117) is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. [Fox Kitten](https://attack.mitre.org/groups/G0117) has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.(Citation: ClearkSky Fox Kitten February 2020)(Citation: CrowdStrike PIONEER KITTEN August 2020)(Citation: Dragos PARISITE )(Citation: ClearSky Pay2Kitten December 2020)

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G0117

Microsoftweather-system names

Lemon Sandstorm

CrowdStrikenation-animal names

Fox KittenPioneer Kitten

MandiantUNC uncategorised cluster

UNC757

DragosICS mineral names

Parisite

Unclassifiedno scheme matched

RUBIDIUM

How we know this

Data origin
MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques
MITRE ATT&CK STIX mappings — 54 ATT&CK techniques on file.
Named victims
None on file.

See how actor data is built for the full pipeline.

Activity timeline

2019: 3 CVE published320192020: 1 CVE published120202021: 4 KEV added420212022: 1 CVE published2022: 1 KEV added220222023: 1 CVE published2023: 1 KEV added220232024: 3 CVE published2024: 3 KEV added620242026: 1 CVE published12026
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2019-11510 KEV10.010.01.00002019-05-08see CVE
CVE-2024-3400 KEV10.010.01.00002024-04-12see CVE
CVE-2019-19781 KEV9.99.81.00002019-12-27see CVE
CVE-2020-5902 KEV9.99.81.00002020-07-01see CVE
CVE-2022-1388 KEV9.99.80.99962022-05-05see CVE
CVE-2023-3519 KEV9.99.80.99752023-07-19see CVE
CVE-2024-21887 KEV9.09.11.00002024-01-12see CVE
CVE-2024-24919 KEV8.88.60.99982024-05-28see CVE
CVE-2019-11539 KEV8.17.20.98622019-04-26see CVE
CVE-2026-20929 6.27.50.02912026-01-13see CVE
CVE-2018-1579 0.00.00.0000see CVE

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
SI-444 / 5481%
CM-641 / 5476%
AC-334 / 5463%
CM-234 / 5463%
AC-232 / 5459%
AC-631 / 5457%
CM-729 / 5454%
IA-225 / 5446%
AC-523 / 5443%
CA-723 / 5443%
CM-522 / 5441%
SI-322 / 5441%
RA-520 / 5437%
SI-719 / 5435%
AC-418 / 5433%

Co-occurring actors

Similar actors

Similar TTPs

Overlapping CVEs

Active in same years

Same nation-state

Same category