AdversaryGraph public intelligence page

This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.

Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.

Main AdversaryGraph project Documentation Malware Analysis GitHub

G0130 · 6 ATT&CK techniques · 1 correlated reports

Ajax Security Team

Aliases: Operation Woolen-Goldfish, AjaxTM, Rocket Kitten, Flying Kitten, Operation Saffron Rose

Ajax Security Team is a group that has been active since at least 2010 and believed to be operating out of Iran. By 2014 Ajax Security Team transitioned from website defacement operations to malware-based cyber espionage campaigns targeting the US defense industrial base and Iranian users of anti-censorship technologies.

Open interactive actor investigation

ATT&CK techniques

T1056.001
KeyloggingT1566.003
Spearphishing via ServiceT1566.001
Spearphishing AttachmentT1204.002
Malicious FileT1555.003
Credentials from Web BrowsersT1105
Ingress Tool Transfer

Correlated CTI and IR reports

Executive Summary
Israel Threat Actors CTI · explicit report mention

Continue the investigation

Interactive AdversaryGraph AdversaryGraph documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas Insider Threat Detection Guide 1200km Medium research