Ajax Security Team
Ajax Security Team is a group that has been active since at least 2010 and believed to be operating out of Iran. By 2014 Ajax Security Team transitioned from website defacement operations to malware-based cyber espionage campaigns targeting the US defense industrial base and Iranian users of anti-censorship technologies.
Properties
- Last source
- MITRE ATT&CK
- STIX ID
- intrusion-set--fa19de15-6169-428d-9cd6-3ca3d56075b7
- In Signal since
- initial import (Sep 2026)
- Retrieved at
- 2026-11-02T00:42:30+00:00
- Type
- intrusion-set
MITRE ATT&CK Techniques (6)
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web bro
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad
Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new ac
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope
Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a sp
Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a sp
Software & Tools (2)
Havij is an automatic SQL Injection tool distributed by the Iranian ITSecTeam security company. Havij has b
sqlmap is an open source penetration testing tool that can be used to automate the process of detecting and
Explore this actor's full graph with Ninja Signal