RedKitten Cyber Campaign: A New Wave of Cyber Attacks

A Farsi-speaking threat actor aligned with Iranian state interests has been suspected to be behind a new campaign targeting non-governmental organizations and individuals involved in documenting recent human rights abuses.

The activity, observed by HarfangLab in January 2026, has been codenamed RedKitten. It's said to coincide with the nationwide unrest in Iran that began towards the end of 2025.

Also Read: Nation-State Actors Unite: Google Exposes Coordinated Cyber Attacks on Defense Sector
  • Targeted organizations include human rights NGOs and activists.
  • The campaign is believed to be aligned with Iranian state interests.
  • The activity was first observed in January 2026 by HarfangLab.

The RedKitten campaign highlights the increasing use of cyber attacks as a means to suppress dissent and silence human rights activists. As the situation in Iran continues to unfold, it's essential for organizations and individuals to remain vigilant and take necessary precautions to protect themselves from such threats.

Passwords are like underwear. Don’t let people see it, change it very often, and don’t share it with strangers.

Chris Pirillo