Ajax Security Team
Ajax Security Team is an Iran-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 14 sectors, including Government and Technology, in 26 countries, including the United States and the United Kingdom. It uses 18 MITRE ATT&CK techniques and exploits 9 known CVEs.
- Operation Woolen-Goldfish
- AjaxTM
- Rocket Kitten
- Flying Kitten
- Operation Saffron Rose
- Group 26
- G0130
- Origin
- Iran
- Techniques
- 18
- Exploited CVEs
- 9
- First seen
- Jan 1, 2010
- Last seen
- Dec 5, 2017
- Record updated
Who They Target.
About Ajax Security Team.
Ajax Security Team is a group that has been active since at least 2010 and believed to be operating out of Iran. By 2014 Ajax Security Team transitioned from website defacement operations to malware-based cyber espionage campaigns targeting the US defense industrial base and Iranian users of anti-censorship technologies.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.