Threat actor · all actors
Ajax Security TeamG0130 state
🇮🇷 IR
aka Ajax Security Team, Operation Woolen-Goldfish, AjaxTM, Rocket Kitten, Flying Kitten, Operation Saffron Rose, SaffronRose, Saffron Rose, AjaxSecurityTeam, Group 26, Sayad, TEMP.Beanie, Operation Woolen Goldfish, Thamar Reservoir, Timberworm
Last updated: 2026-08-22
About this actor
[Ajax Security Team](https://attack.mitre.org/groups/G0130) is a group that has been active since at least 2010 and believed to be operating out of Iran. By 2014 [Ajax Security Team](https://attack.mitre.org/groups/G0130) transitioned from website defacement operations to malware-based cyber espionage campaigns targeting the US defense industrial base and Iranian users of anti-censorship technologies.(Citation: FireEye Operation Saffron Rose 2013)
Source: MITRE ATT&CK
Names & naming systems
Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.
MITRE ATT&CKG-number catalogue id
CrowdStrikenation-animal names
MandiantTEMP temporary cluster
Unclassifiedno scheme matched
How we know this
- Data origin
- MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
- Techniques
- MITRE ATT&CK STIX mappings — 10 ATT&CK techniques on file.
- Named victims
- None on file.
See how actor data is built for the full pipeline.
Activity timeline
- 2026 — 1 CVE published
Profile
| CVE | Risk | CVSS | EPSS | Published | Products |
|---|---|---|---|---|---|
CVE-2026-20929 | 5.9 | 7.5 | 0.0116 | 2026-01-13 | see CVE |
Mitigating controls (NIST 800-53)
| Control | Techniques covered | Coverage |
|---|---|---|
CA-7 | 7 / 10 | 70% |
SI-4 | 7 / 10 | 70% |
AC-4 | 6 / 10 | 60% |
SC-7 | 6 / 10 | 60% |
SI-3 | 6 / 10 | 60% |
CM-2 | 5 / 10 | 50% |
CM-6 | 5 / 10 | 50% |
SC-44 | 5 / 10 | 50% |
SI-2 | 5 / 10 | 50% |
SI-8 | 5 / 10 | 50% |
CM-7 | 3 / 10 | 30% |
AC-6 | 2 / 10 | 20% |
IA-9 | 2 / 10 | 20% |
SC-20 | 2 / 10 | 20% |
SI-10 | 2 / 10 | 20% |
Co-occurring actors
- APT29 1 shared CVEs
- APT38 1 shared CVEs
- Sandworm Team 1 shared CVEs
- Tonto Team 1 shared CVEs
- GOLD SOUTHFIELD 1 shared CVEs
- Scattered Spider 1 shared CVEs
- OilRig 1 shared CVEs
- Indrik Spider 1 shared CVEs
- Mustang Panda 1 shared CVEs
- SolarWinds Compromise 1 shared CVEs
Similar actors
Similar TTPs
- APT30 0.40
- PLATINUM 0.39
- Nomadic Octopus 0.31
- Elderwood 0.29
- IndigoZebra 0.29
Active in same years
- Operation Dream Job 1.00
- SolarWinds Compromise 1.00
- C0027 1.00
- SharePoint ToolShell Exploitation 1.00
- Ke3chang 1.00
Same nation-state
- HomeLand Justice 1.00
- Outer Space 1.00
- Juicy Mix 1.00
- Cleaver 1.00
- OilRig 1.00
Same category
- Night Dragon 1.00
- FunnyDream 1.00
- C0011 1.00
- Operation Wocao 1.00
- Operation Dream Job 1.00