Rocket_Kitten__2015__wp-operation-woolen-goldfish.pdf
ID: f5bdd3b0-4a59-46d1-9c50-fcbf124b4b09
STIX ID: report--f5bdd3b0-4a59-46d1-9c50-fcbf124b4b09
Threat Score
75/100
Uploaded: 2026-08-19
Published Date: 2015-03-19
Last Modified Date: 2015-03-19
Created by: dogesec
TLP:CLEAR
ADMIRALTY:B2
PAP:CLEAR
...
...
Trend Micro analyzes Rocket Kitten's Operation Woolen-GoldFish and related GHOLE campaigns targeting Israeli and European government, defense, academic and private-sector organizations; infections are delivered via spear-phishing (malicious Office macros or OneDrive-hosted executables) and deploy backdoor/keylogger payloads (GHOLE, WOOLERG/CWoolger) with hard-coded C2 IPs, embedded credentials, and multiple SHA1 indicators of compromise.