Nemesis Kitten — APT Profile
Nemesis Kitten (DEV-0270) is an IRGC-linked Iranian group deploying BitLocker ransomware while simultaneously conducting espionage operations.Also tracked as
DEV-0270, COBALT MIRAGE, Storm-0270
IntelFusions coverage (1)
- APT42: Iran's IRGC-Linked Espionage Group Deploys Multi-Persona Phishing and Android Spyware Against Dissidents 2026-02-16 · Nation-State
Vendor research
- Log4j2 In The Wild | Iranian-Aligned Threat Actor "TunnelVision" Actively Exploiting VMware Horizon SentinelOne (SentinelLabs)
- Drokbk Malware Uses GitHub as Dead Drop Resolver Secureworks Counter Threat Unit
- Opsec Mistakes Reveal COBALT MIRAGE Threat Actors Secureworks Counter Threat Unit
- Profiling DEV-0270: PHOSPHORUS' ransomware operations Microsoft Threat Intelligence (MSTIC/DART)
- COBALT MIRAGE conducts ransomware operations in U.S. Secureworks Counter Threat Unit