Flying Kitten

🇮🇷Iran-attributed

aliases

Last seen:May 20, 2026

Intelligence Profile

Activity: defense and aerospace sectors, also interested in targeting entities in the oil/gas industry.

Threat Analysis

Flying Kitten is a known-sophistication threat actor attributed to Iran, engaged in cyber operations with a primary motivation of espionage.

The group's espionage-oriented operations suggest a state-sponsored or state-aligned mandate, typically focused on stealing intellectual property, government secrets, or military intelligence. Targets are usually selected for strategic value rather than financial gain.

External References

→https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-operation-saffron-rose.pdf

→https://www.crowdstrike.com/blog/cat-scratch-fever-crowdstrike-tracks-newly-reported-iranian-actor-flying-kitten/

→https://www.cfr.org/interactive/cyber-operations/saffron-rose

Quick Facts

TypeAPT / Threat Group

Motivation🕵️ espionage

Origin🇮🇷 Iran

Aliases7

SourceMalpedia

Also Known As

AjaxSecurityTeamGroup 26SayadAjax Security TeamFlying KittenSaffron RoseSaffronRose

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Flying Kitten