🇮🇷

CopyKittens

APT Group Information theft and espionage ETDA ✓

Also Known As 2 names

G0052 Slayer Kitten

Target Countries 6

Countries highlighted in red

Germany Israel Jordan Saudi Arabia Turkey United States

Sectors Targeted

Government IT Media Defense Education

Details

Origin 🇮🇷 IR

Last Updated 01 Jun 2022

Malware Families 1

matryosh

MITRE ATT&CK 18

T1047 T1059 T1059.001 T1071 T1090 T1105 T1218 T1218.011 T1553 T1553.002 T1560 T1560.001 T1560.003 T1564 T1564.003 T1566.001 T1588 T1588.002

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 3 entries

CopyKittens Trend Micro

Slayer Kitten CrowdStrike

G0052 MITRE

Observed Target Countries 6

Based on ETDA data — countries highlighted in red

Germany Israel Jordan Saudi Arabia Turkey USA

Description

CopyKittens is an Iranian cyberespionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany. The group is responsible for the campaign known as Operation Wilted Tulip.

Tools Used 6

Cobalt Strike EmpireProject Matryoshka RAT TDTESS Vminst ZPP

Operations 3

2013 Operation “Wilted Tulip” In this report, Trend Micro and ClearSky expose a vast espionage apparatus spanning the entire time the group has been active. It includes recent incidents as well as older ones that have not been publicly reported; new malware; exploitation, delivery and command and control infrastructure; and the group’s modus operandi. We dubbed this activity Operation Wilted Tulip. https://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf

2015 CopyKittens has conducted at least three waves of cyber-attacks in the past year. In each of the attacks the infection method was almost identical and included an extraordinary number of stages used to avoid detection. As with other common threat actors, the group relies on social engineering methods to deceive its targets prior to infection. https://s3-eu-west-1.amazonaws.com/minervaresearchpublic/CopyKittens/CopyKittens.pdf

2017-01 Breach of the Israeli newspaper Jerusalem Post As part of our monitoring of Iranian threat agents activities, we have detected that since October 2016 and until the end of January 2017, the Jerusalem Post, as well as multiple other Israeli websites and one website in the Palestinian Authority were compromised by Iranian threat agent CopyKittens. https://www.clearskysec.com/copykitten-jpost/

ETDA Profile

CopyKittens, Slayer Kitten

Origin

Iran

First Seen 2013

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0052/

View on ETDA APT Groups ↗