G0052 · 8 ATT&CK techniques · 0 correlated reports

CopyKittens

Aliases: None listed

CopyKittens is an Iranian cyber espionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany. The group is responsible for the campaign known as Operation Wilted Tulip.

Open interactive actor investigation

ATT&CK techniques

T1560.003
Archive via Custom MethodT1560.001
Archive via UtilityT1059.001
PowerShellT1090
ProxyT1218.011
Rundll32T1564.003
Hidden WindowT1588.002
ToolT1553.002
Code Signing

Correlated CTI and IR reports

Continue the investigation

Interactive ThreatMapper ThreatMapper documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas ITDR Handbook 1200km Medium research