Rocket_Kitten__2015__rocket-kitten-report.pdf

Check Point Threat Intelligence analyzes the Rocket Kitten campaign attributed to Iranian actors, describing persistent spear-phishing campaigns and associated malware (Ghooler, CWoolger, FireMalv, MPK, Woolen) and the attackers' infrastructure, including victim targeting across the Middle East, Europe, and the US, a web-based phishing platform called Oyun, and multiple indicators of compromise and artifacts, with notes on attacker identities and operational security shortcomings.