Imperial Kitten APT Targets Aerospace and Defense Sectors

• •Imperial Kitten targets aerospace and defense sectors using credential-validated phishing.
• •The group utilizes Microsoft Azure for command and control, complicating detection efforts.
• •Organizations should strengthen email security and monitor for unusual registry changes.

Imperial Kitten, an Iranian APT linked to the IRGC, has been active since 2017, focusing on aerospace and defense organizations globally. The group employs sophisticated spearphishing campaigns and credential-validated portals to deliver custom malware, including backdoors like TWOSTROKE and MINIBIKE. Recent activities have involved using Microsoft Azure for command and control communications, blending malicious traffic with legitimate cloud activity. The group has evolved from supply chain attacks to social media catfishing and tailored phishing tactics. Organizations are advised to enhance email security, monitor registry changes, and restrict outbound traffic to mitigate risks. The threat landscape remains active as of November 2026, with ongoing operations reported across multiple countries.