Dark Web Profile: Fox Kitten

**Executive summary:** This SOCRadar report profiles Fox Kitten (aka Pioneer Kitten/UNC757 and other aliases), an Iranian state-aligned APT that simultaneously conducts espionage and brokers initial access to ransomware affiliates; it documents rapid exploitation of internet-facing VPN/firewall vulnerabilities (including recent zero-days), credential theft and tunneling-based C2, multiple custom backdoors and malware, several multi-year campaigns affecting critical infrastructure and U.S. organizations, and provides prioritized mitigations for patching, detection, and hunting.