Imperial Kitten

Reported Context (5)

The article attributes phishing, credential theft, DLL side-loading, and C2 operations targeting aerospace, defense, and IT organizations to this group. Imperial Kitten Uses Credential-Gated Phishing and Resilient Azure C2
Used EvilGinx2 for credential phishing against Israeli Microsoft 365 users in November 2025, followed by account enumeration. CrowdStrike 2026 Threat Report Finds Faster Intrusions and Rising AI-Enabled Attacks
Named in the article as an alias of Tortoiseshell. Nimbus Manticore Adds TWOSTROKE-Like Backdoor and Reverse SSH Tunneler
IRGC-aligned actor whose domestic-dissident targeting tradecraft HarfangLab compared with RedKitten; no alias relationship was established. Report: AI Is Scaling Iran’s Cyber and Influence Operations, Not Transforming Its Playbook
Dragos said Pyroxene's activity overlaps with activity attributed to Imperial Kitten, which the article identifies as also known as APT35. Dragos Report Details Voltzite Activity and Three New OT Threat Groups

CVE (13)

Malware (25)

People (14)

Threat Actors (46)

MITRE ATT&CK (39)

Vendors (24)

Products (36)

Tools (13)

Industries (22)

Countries (20)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.