Wicked Kitten

Profile narrative

The threat actor referenced as Wicked Kitten appears in open-source discussions under that alias. No additional names or alternate monikers have been publicly associated with this identifier. The limited references suggest that Wicked Kitten is primarily known through a single source or a few mentions. Consequently, a comprehensive overview of the actor's origins or history cannot be constructed from available material.

Regarding targeting, no specific industries, sectors, or geographic regions have been explicitly linked to Wicked Kitten in any reported analysis. The absence of such details means that any inference about preferred victims or locations would be unsupported. Therefore, the actor's strategic objectives, whether financial gain, espionage, or disruption, remain undocumented in public reporting. Without concrete evidence, it is not possible to assign a motive or goal to the group.

In terms of tactics, techniques, and procedures, no malware families, exploit tools, or custom utilities have been definitively attributed to Wicked Kitten. Likewise, no initial access vectors such as phishing, supply‑chain compromise, or vulnerability exploitation have been described in connection with this alias. The lack of described tooling or operational methods prevents any characterization of the actor's technical style or sophistication level.

Attribution to any state‑sponsored program, criminal consortium, or hacker‑for‑hire outfit has not been established in reliable sources. Similarly, no specific campaigns, intrusion sets, or publicly reported operations have been tied to Wicked Kitten. As a result, there are no notable incidents or operation names that can be cited as representative examples of the actor's activity. The current knowledge base consists solely of the alias itself, with no further verifiable details available.

Incidents

Attributed incidents are available to members.