Operation Kitten: Hacktivist Groups Targeting Israel with Cyberattacks
The "kitten" platform has emerged as a coordination hub for hacktivist campaigns targeting Israel, bridging the gap between cyber activism and state-aligned influence.
The "kitten" platform has emerged as a coordination hub for hacktivist campaigns targeting Israel, bridging the gap between cyber activism and state-aligned influence.
Though operators deny direct ties to Iran, technical evidence suggests a close relationship with the Iranian cybersecurity ecosystem and pro-Iranian hacktivist groups.
The "kitten" project operates as a semi-private environment where select hacktivist actors can upload files, participate in private chat rooms, and organize information operations.
Currently, access is limited to three main hacktivist groups: "Handala Hacking Group," "KilledByIsrael," and "CyberIsnaadFront."
These groups have been involved in doxing operations, exposing personal data of Israeli soldiers and civilians, and attempting to compromise industrial systems, including ICS and PLC environments.
The operators behind "kitten" publicly maintain that they are not based in Iran and assert independence in their operations against Israel. However, technical analysis reveals early development ties to Iranian infrastructure.
The "kitten" platform has emerged as a coordination hub for hacktivist campaigns targeting Israel, bridging the gap between cyber activism and state-aligned influence.
Before acquiring the domain thekitten[.]group, a "demo" version of the platform was hosted on a subdomain of the Iranian portal zagrosguard.ir, indicating a development path through Iranian infrastructure.
An Iranian IP address associated with this subdomain links the project to the broader Iranian cybersecurity network fronted by "Zagros." This service markets itself as a domestic product allowing access to sensitive systems via Iranian IP addresses.
Zagros is described as a platform for programmers, gamers, students, and professionals needing access to financial markets and sensitive platforms without foreign VPNs. However, it lacks verifiable corporate registrations, suggesting it may serve to enable activity that violates Iranian sanctions.
The infrastructure that offers secure Iranian IP-based access is also used to support politically motivated cyber operations.
Analysis of the HTML code behind early "kitten" instances confirms that the platform was developed within a Zagros subdomain before moving to its current domain.
Contact details in the code lead to phone numbers associated with a Turkish virtual operator, suggesting an effort to obscure the operators' actual location.
Further investigation revealed recruitment postings in Farsi for programmers and security testers, indicating active efforts to build technical capacity.
An examination of an exposed backup of the "admin" panel showed a structured architecture for managing media, projects, and content, with PHP scripts controlling access to stored media.
These findings indicate that the "kitten" project is a technically sophisticated, Iran-linked infrastructure node, facilitating coordination and operational security for hacktivist collectives targeting Israeli entities.
Based on reporting by GBHackers.
