AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
Ajax Security Team
Aliases: Ajax Security Team, AjaxTM, Flying Kitten, Operation Saffron Rose, Operation Woolen-Goldfish, Rocket Kitten
[Ajax Security Team](https://attack.mitre.org/groups/G0130) is a group that has been active since at least 2010 and believed to be operating out of Iran. By 2014 [Ajax Security Team](https://attack.mitre.org/groups/G0130) transitioned from website defacement operations to malware-based cyber espionage campaigns targeting the US defense industrial base and Iranian users of anti-censorship technologies.(Citation: FireEye Operation Saffron Rose 2013)
Open interactive actor investigation
ATT&CK techniques
Correlated CTI and IR reports
Continue the investigation
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- Havij tool reference — Explicit actor uses software relationship in pinned ATT&CK
- sqlmap tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1056.001 Keylogging simulation — Exact active technique ID
- T1056.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1105 Ingress Tool Transfer simulation — Exact active technique ID
- T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.002 Malicious File simulation — Exact active technique ID
- T1204.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1555.003 Credentials from Web Browsers simulation — Exact active technique ID
- T1555.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.001 Spearphishing Attachment simulation — Exact active technique ID
- T1566.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.003 Spearphishing via Service simulation — Exact active technique ID
- T1566.003 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Cyber Threat Intelligence (CTI) · topic-matchModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · topic-matchEndpoint live response and volatile acquisition
Digital Forensics & Incident Response (DFIR) · topic-matchPrivacy, secrets, confidential data, and model leakage
AI Security · topic-matchGovernance, organizational context, and accountable authority
Governance, Risk & Compliance (GRC) · topic-matchScope, business services, assets, dependencies, and data
Governance, Risk & Compliance (GRC) · topic-matchCloud, DevSecOps, product, and control-as-code governance
Governance, Risk & Compliance (GRC) · topic-matchWeakness taxonomy and vulnerability identity
Vulnerability Research & Exploit Development · topic-matchControl design, ownership, inheritance, and lifecycle
Governance, Risk & Compliance (GRC) · topic-matchEvidence engineering, control testing, audit, and assurance
Governance, Risk & Compliance (GRC) · topic-matchMetrics, KRIs, reporting, and maturity without vanity scores
Governance, Risk & Compliance (GRC) · topic-matchModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · tactic-route